PT-2025-46658 · Rest Api · Rest Api

Published 2025-11-11 · Updated 2025-11-13 · CVE-2025-11566

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions versions prior to 2025 (affected versions not specified)

Description An issue exists that allows an attacker on the local network to gain access to a user account by performing an arbitrary number of authentication attempts with different credentials. This is due to improper restriction of excessive authentication attempts. The issue affects the /REST/shutdownnow API endpoint. The credentials variable is subject to abuse.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BDU:2025-14355

CVE-2025-11566

Affected Products

Rest Api

References · 7

• https://bdu.fstec.ru/vul/2025-14355 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-11566 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-315-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-315-01.pdf · Note
• https://twitter.com/CVEnew/status/1988721734028079142 · Twitter Post
• https://t.me/cveNotify/142528 · Telegram Post
• https://t.me/CVEtracker/37141 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1988759484559180152 · Twitter Post