PT-2025-45591 · Hundred Plus · Hundred Plus Eip Plus

CVE-2025-12866 · Published 2025-11-10 · Updated 2025-11-15

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hundred Plus EIP Plus (affected versions not specified)

Description The software contains a Weak Password Recovery Mechanism, allowing unauthenticated remote attackers to predict or brute-force the 'forgot password' link or token. Successful exploitation enables attackers to reset any user's password, resulting in full account takeover. The vulnerability affects all versions of the software.

Recommendations Disable the password recovery feature immediately. Enable multi-factor authentication (MFA).

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2025-12866

Affected Products

Hundred Plus Eip Plus

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2025-12866 · Security Note
• https://t.me/CVEtracker/36885 · Telegram Post
• https://twitter.com/CVEnew/status/1987729280843784208 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1987768693770600923 · Twitter Post
• https://twitter.com/offseq/status/1987762383461241260 · Twitter Post
• https://twcert.org.tw/en/cp-139-10491-004b0-2.html · Note
• https://twitter.com/transilienceai/status/1987724773774770412 · Twitter Post
• https://t.me/cveNotify/142236 · Telegram Post
• https://twitter.com/0dayPublishing/status/1987719294206066833 · Twitter Post
• https://twcert.org.tw/tw/cp-132-10490-2534b-1.html · Note
• https://chtsecurity.com/news/20848f61-9db5-44fd-8574-c9d6a54e4010 · Note
• https://t.me/cveNotify/142574 · Telegram Post
• https://twitter.com/gothburz/status/1989710427886886928 · Twitter Post
• https://twitter.com/cracbot/status/1989287242150662369 · Twitter Post
• https://twitter.com/CveFindCom/status/1987757574955864417 · Twitter Post