{"id":"CVE-2025-0674","aliases":["EUVD-2025-1810","GHSA-prgf-4jmg-r3v9"],"status":"published","title":"Elber Communications Equipment Authentication Bypass Using an Alternate Path or Channel","description":"Multiple Elber products are affected by an authentication bypass \nvulnerability which allows unauthorized access to the password \nmanagement functionality. Attackers can exploit this issue by \nmanipulating the endpoint to overwrite any user's password within the \nsystem. This grants them unauthorized administrative access to protected\n areas of the application, compromising the device's system security.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03654,"percentile":0.89706,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-288"],"published":"2025-02-06T23:42:33Z","modified":"2026-06-17T08:26:56Z","exploits":[{"source":"nuclei","id":"CVE-2025-0674","title":"Elber ESE DVB-S/S2 - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0674.yaml"}],"products":[{"vendor":"elber","product":"cleber/3 broadcast multi-purpose platform"},{"vendor":"elber","product":"ese dvb-s/s2 satellite receiver"},{"vendor":"elber","product":"reble610 m/odu xpic ip-asi-sdh"},{"vendor":"elber","product":"signum dvb-s/s2 ird"},{"vendor":"elber","product":"wayber analog/digital audio stl"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-03"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0674"},{"url":"https://github.com/advisories/GHSA-prgf-4jmg-r3v9"}],"sources":{"cve":[{"id":"CVE-2025-0674","title":"Elber Communications Equipment Authentication Bypass Using an Alternate Path or Channel","description":"Multiple Elber products are affected by an authentication bypass \nvulnerability which allows unauthorized access to the password \nmanagement functionality. Attackers can exploit this issue by \nmanipulating the endpoint to overwrite any user's password within the \nsystem. This grants them unauthorized administrative access to protected\n areas of the application, compromising the device's system security.","status":"published","published":"2025-02-06T23:42:33.517Z","modified":"2025-02-12T19:41:07.823Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:32:53.475217Z"}],"euvd":[{"id":"EUVD-2025-1810","description":"Multiple Elber products are affected by an authentication bypass \nvulnerability which allows unauthorized access to the password \nmanagement functionality. Attackers can exploit this issue by \nmanipulating the endpoint to overwrite any user's password within the \nsystem. This grants them unauthorized administrative access to protected\n areas of the application, compromising the device's system security.","status":"published","published":"2025-02-06T23:42:33Z","modified":"2025-02-12T19:41:07Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-03T00:03:57.395516Z"}],"ghsa":[{"id":"GHSA-prgf-4jmg-r3v9","title":"Multiple Elber products are affected by an authentication bypass \nvulnerability which allows...","description":"Multiple Elber products are affected by an authentication bypass \nvulnerability which allows unauthorized access to the password \nmanagement functionality. Attackers can exploit this issue by \nmanipulating the endpoint to overwrite any user's password within the \nsystem. This grants them unauthorized administrative access to protected\n areas of the application, compromising the device's system security.","status":"published","published":"2025-02-07T03:32:03Z","modified":"2025-02-07T03:32:09Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:59:49.339987Z"}],"nvd":[{"id":"CVE-2025-0674","description":"Multiple Elber products are affected by an authentication bypass \nvulnerability which allows unauthorized access to the password \nmanagement functionality. Attackers can exploit this issue by \nmanipulating the endpoint to overwrite any user's password within the \nsystem. This grants them unauthorized administrative access to protected\n areas of the application, compromising the device's system security.","status":"published","published":"2025-02-07T00:15:27.017Z","modified":"2026-06-17T08:26:56.73Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:10:50.916773Z"}]}}