PT-2025-47459 · Axel Technology · Wolf1Ms+1

Published 2025-11-19 · Updated 2025-11-24 · CVE-2025-63218

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Axel Technology WOLF1MS and WOLF2MS versions 0.8.5 through 1.0.3

Description The devices are subject to Broken Access Control because of a lack of authentication on the /cgi-bin/gstFcgi.fcgi API endpoint. This allows unauthenticated remote attackers to perform actions such as listing user accounts, creating new administrative users, deleting users, and modifying system settings, potentially leading to a full compromise of the device.

Recommendations Versions 0.8.5 through 1.0.3 should be updated to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Improper Access Control

Improper Authorization

Weakness Enumeration

CWE-284

CWE-285

Related Identifiers

CVE-2025-63218

Affected Products

Wolf1Ms

Wolf2Ms

References · 8

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63218_Axel%20Technology%20WOLF1MS%20and%20WOLF2MS%20-%20Broken%20Access%20Control · Exploit
• https://osv.dev/vulnerability/CVE-2025-63218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63218 · Security Note
• https://axeltechnology.com · Note
• https://t.me/cveNotify/143379 · Telegram Post
• https://t.me/cveNotify/143369 · Telegram Post
• https://twitter.com/CVEnew/status/1991187300995461334 · Twitter Post
• https://twitter.com/cracbot/status/1992911129002340715 · Twitter Post