PT-2025-7178 · Rupeeweb · Rupeeweb

Mohit Gadiya · Published 2025-02-14 · Updated 2025-02-14 · CVE-2025-26524

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: RupeeWeb trading platform (affected versions not specified)

Description: The issue is caused by missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this by sending multiple OTP requests through vulnerable API endpoints, leading to OTP bombing or flooding on the targeted system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-799

Related Identifiers

CVE-2025-26524

Affected Products

Rupeeweb

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-26524 · Security Note
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020 · Note
• https://twitter.com/CVEnew/status/1890411340864356608 · Twitter Post
• https://t.me/cvenotify/111363 · Telegram Post