PT-2025-43366 · Nautobot · Nautobot

Published 2025-10-21 · Updated 2025-10-22 · CVE-2025-62607

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nautobot Single Source of Truth (SSoT) versions prior to 3.10.0

Description An unauthenticated attacker could access a page to view the Service Now public instance name, such as companyname.service-now.com. This does not expose the Secret, the Secret Name, or the Secret Value for the Username/Password for Service-Now.com. An unauthenticated member cannot change the instance name or set a Secret. Access to other pages within Nautobot is not possible through this unauthenticated page.

Recommendations Update to version 3.10.0 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-62607

GHSA-535G-62R7-CX6V

Affected Products

Nautobot

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62607.json · Exploit
• https://osv.dev/vulnerability/GHSA-535g-62r7-cx6v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62607 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62607 · Vendor Advisory
• https://github.com/nautobot/nautobot-app-ssot/security/advisories/GHSA-535g-62r7-cx6v · Note
• https://github.com/nautobot/nautobot-app-ssot/releases/tag/v3.10.0 · Note
• https://github.com/nautobot/nautobot-app-ssot · Note
• https://github.com/nautobot/nautobot-app-ssot/commit/1530d25cdeb929641ec47644f9a0a1d9d41e1cb8 · Note
• https://twitter.com/CVEnew/status/1981046806613258263 · Twitter Post
• https://t.me/CVEtracker/35496 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1odakwu/resumen_diario_de_vulnerabilidades_22102025 · Reddit Post