PT-2025-47469 · Axel Technology · Puma

Published 2025-11-19 · Updated 2025-11-19 · CVE-2025-63221

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Axel Technology puma versions 0.8.5 through 1.0.3

Description The devices are susceptible to Broken Access Control because of a lack of authentication on the /cgi-bin/gstFcgi.fcgi endpoint. This allows unauthenticated remote attackers to perform actions such as listing user accounts, creating new administrative users, deleting users, and modifying system settings, potentially resulting in full device compromise.

Recommendations Apply updates to versions beyond 1.0.3.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-63221

Affected Products

Puma

References · 6

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63221_Axel%20Technology%20puma%20-%20Broken%20Access%20Control · Exploit
• https://osv.dev/vulnerability/CVE-2025-63221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63221 · Security Note
• https://axeltechnology.com · Note
• https://t.me/cveNotify/143386 · Telegram Post
• https://twitter.com/CVEnew/status/1991187304472539306 · Twitter Post