PT-2025-53650 · Joey Zhou · Xiaozhi-Esp32-Server-Java

Zzdzz · Published 2025-12-28 · Updated 2025-12-28 · CVE-2025-15135

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions joey-zhou xiaozhi-esp32-server-java versions up to 3.0.0

Description A flaw exists in the Cookie Handler component’s tryAuthenticateWithCookies() function within the AuthenticationInterceptor.java file. Manipulation of this function can result in improper authentication. This issue is remotely exploitable, and details of the exploit are publicly available.

Recommendations Upgrade to version 4.0.0.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-15135

Affected Products

Xiaozhi-Esp32-Server-Java

References · 12

• 🔥 https://github.com/joey-zhou/xiaozhi-esp32-server-java/issues/143#issue-3722315701 · Exploit
• https://github.com/joey-zhou/xiaozhi-esp32-server-java/releases/tag/v4.0.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-15135 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15135 · Vendor Advisory
• https://github.com/joey-zhou/xiaozhi-esp32-server-java/issues/143#issuecomment-3666534810 · Note
• https://github.com/joey-zhou/xiaozhi-esp32-server-java/issues/143 · Note
• https://t.me/cveNotify/146974 · Telegram Post
• https://vuldb.com/?ctiid.338513 · Note
• https://t.me/CVEtracker/40771 · Telegram Post
• https://twitter.com/CVEnew/status/2005264872351625602 · Twitter Post
• https://vuldb.com/?submit.713990 · Note
• https://vuldb.com/?id.338513 · Note