PT-2025-43933 · Zytec Dalian Zhuoyun Technology · Zytec Dalian Zhuoyun Technology Central Authentication Service

Badkitty · Published 2025-10-27 · Updated 2025-10-27 · CVE-2025-12266

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zytec Dalian Zhuoyun Technology Central Authentication Service versions prior to 20251010

Description A code injection issue exists in the Central Authentication Service. The issue is located in the empty function of the /index.php/auth/widget file. Manipulation of the get.layer, get.widget, and get.action arguments can lead to code injection. The exploit is publicly available and the vendor was notified but did not respond.

Recommendations Versions prior to 20251010 should be updated. As a temporary workaround, restrict access to the /index.php/auth/widget file. Avoid using the get.layer, get.widget, and get.action parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2025-12266

Affected Products

Zytec Dalian Zhuoyun Technology Central Authentication Service

References · 7

• 🔥 http://101.200.76.102:38765/qwertyuiop/Vuldb/Zytec.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12266 · Security Note
• https://t.me/cveNotify/140435 · Telegram Post
• https://vuldb.com/?submit.671721 · Note
• https://vuldb.com/?id.329938 · Note
• https://twitter.com/CVEnew/status/1982771807980532072 · Twitter Post
• https://vuldb.com/?ctiid.329938 · Note