PT-2025-53348 · Unknown · Soca Access Control System

Published 2025-12-24 · Updated 2025-12-24 · CVE-2018-25127

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SOCA Access Control System version 180612

Description The SOCA Access Control System is susceptible to a cross-site request forgery condition. This allows attackers to execute administrative actions without sufficient verification of requests. Specifically, attackers can create admin accounts by deceiving authenticated users into visiting a malicious website that submits forged requests. The API endpoint used for creating admin accounts is vulnerable to this attack. The vulnerability occurs because the system does not properly validate requests, allowing attackers to submit forged requests on behalf of authenticated users.

Recommendations Ensure proper request validation is implemented to prevent unauthorized administrative actions.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-25127

Affected Products

Soca Access Control System

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-25127 · Security Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2019-5520.php · Note
• https://t.me/cveNotify/146799 · Telegram Post
• http://socatech.com · Note
• https://exploit-db.com/exploits/46834 · Note