PT-2025-48410 · Nutzam · Nutzboot

Sh7Err03 · Published 2025-12-01 · Updated 2025-12-30 · CVE-2025-13806

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nutzam NutzBoot versions up to 2.6.0-SNAPSHOT

Description A security issue exists in nutzam NutzBoot related to improper authorization within the Transaction API. The issue stems from manipulation of the from, to, and wei arguments in an unknown function within the file nutzboot-demo/nutzboot-demo-simple/nutzboot-demo-simple-web3j/src/main/java/io/nutz/demo/simple/module/EthModule.java. Remote exploitation is possible, and the exploit has been publicly disclosed.

Recommendations Versions prior to 2.6.0-SNAPSHOT should be used.

Exploit

Fix

Incorrect Authorization

Incorrect Privilege Assignment

Improper Authorization

Weakness Enumeration

CWE-863

CWE-266

CWE-285

Related Identifiers

CVE-2025-13806

GHSA-53V5-9752-QQ92

Affected Products

Nutzboot

References · 16

• 🔥 https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-UnauthorizedTransfer-1/report.md · Exploit
• 🔥 https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-UnauthorizedTransfer-1/report.md#vulnerability-details-and-poc · Exploit
• https://osv.dev/vulnerability/CVE-2025-13806 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-53v5-9752-qq92 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13806 · Security Note
• https://github.com/nutzam/nutzboot · Note
• https://t.me/CVEtracker/38503 · Telegram Post
• https://twitter.com/cracbot/status/1996897390998270409 · Twitter Post
• https://vuldb.com/?submit.692061 · Note
• https://twitter.com/cracbot/status/1997259776770834934 · Twitter Post
• https://vuldb.com/?id.333816 · Note
• https://twitter.com/offseq/status/1995350326073819297 · Twitter Post
• https://twitter.com/CVEnew/status/1995359308360388833 · Twitter Post
• https://t.me/cveNotify/147136 · Telegram Post
• https://vuldb.com/?ctiid.333816 · Note