PT-2026-23502 · Opencode Systems · Oc Messaging / Ussd Gateway

Published 2026-03-05 · Updated 2026-05-06 · CVE-2025-70614

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenCode Systems OC Messaging / USSD Gateway version 6.32.2

Description The software contains a flaw in access control within the web-based control panel. An authenticated attacker with limited privileges can access arbitrary SMS messages by manipulating the company or tenant identifier parameter. The vulnerable parameter is company or tenant identifier.

Recommendations Apply any available updates to address the access control issue in the web-based control panel. As a temporary workaround, restrict access to the web-based control panel to only authorized personnel.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-70614

Affected Products

Oc Messaging / Ussd Gateway

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-70614 · Security Note
• https://twitter.com/VulmonFeeds/status/2029707518310539383 · Twitter Post
• https://t.me/cveNotify/162401 · Telegram Post
• https://twitter.com/CVEnew/status/2030755444088598980 · Twitter Post
• https://twitter.com/TheHackerWire/status/2030584318259868092 · Twitter Post
• https://gist.github.com/whiteman0007/e02b8cfd6c67ff1eaaf54fba041582a1 · Note
• https://twitter.com/windowsforum/status/2037216184177709468 · Twitter Post