PT-2025-47468 · Blackberry · Blackberry Athoc

Published 2025-11-19 · Updated 2025-12-01 · CVE-2025-12766

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions BlackBerry AtHoc (OnPrem) version 7.21

Description An Insecure Direct Object Reference (IDOR) exists in the Management Console of BlackBerry AtHoc (OnPrem) version 7.21. This flaw could allow an attacker to obtain unauthorized information about other organizations hosted on the same Interactive Warning System (IWS). The issue involves an improper access control mechanism, potentially allowing unauthorized access to sensitive data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-12766

Affected Products

Blackberry Athoc

References · 6

• https://support.blackberry.com/pkb/s/article/140929 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12766 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12766 · Vendor Advisory
• https://twitter.com/dailycve/status/1995574161016815852 · Twitter Post
• https://twitter.com/CVEnew/status/1991187292443275634 · Twitter Post
• https://support.blackberry.com/community/s/article/140929 · Note