PT-2025-44151 · Asseco · Asseco Mmedica

Published 2025-10-28 · Updated 2025-10-28 · CVE-2025-9313

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Asseco mMedica versions prior to 11.9.5

Description An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through the mmBackup application. This allows attackers to bypass authentication mechanisms and gain unauthorized access to sensitive data within the database.

Recommendations Update Asseco mMedica to version 11.9.5 or later.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-9313

Affected Products

Asseco Mmedica

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-9313 · Security Note
• https://cert.pl/en/posts/2025/10/CVE-2025-9313 · Note
• https://t.me/CVEtracker/35958 · Telegram Post
• https://mmedica.asseco.pl · Note
• https://twitter.com/0dayPublishing/status/1983140325532029182 · Twitter Post
• https://twitter.com/CVEnew/status/1983149433316618514 · Twitter Post
• https://twitter.com/CveFindCom/status/1983144253862613121 · Twitter Post