PT-2025-49549 · Unknown · Vulnerability-Lookup

Published 2025-12-08 · Updated 2025-12-08 · CVE-2025-42615

Positive Technologies (AI Summary)

CVSS v4.0

8.1

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vulnerability-Lookup versions prior to 2.18.0

Description The software did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA) verification. An attacker with a valid username and password could submit numerous OTP codes without account lockout or administrator alerts. This lack of rate-limiting and lockout reduces the cost of brute-force attacks against 2FA codes, increasing the risk of account takeover, particularly with low-entropy OTPs. Administrators lacked visibility into repeated 2FA failures, hindering detection of targeted attacks. The patch introduces a failed otp attempts counter, locks accounts after five invalid submissions, resets the counter upon successful verification, and displays failed attempts in the admin user list, improving monitoring and enforcing an account lockout policy.

Recommendations Upgrade to version 2.18.0 or later.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2025-42615

Affected Products

Vulnerability-Lookup

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-42615 · Security Note
• https://vulnerability.circl.lu/vuln/gcve-1-2025-0033 · Vendor Advisory
• https://t.me/CVEtracker/39118 · Telegram Post
• https://t.me/cveNotify/145100 · Telegram Post