{"id":"CVE-2025-53968","aliases":["EUVD-2026-4499","GHSA-g774-49mh-xqjp"],"status":"published","title":"EVMAPA Improper Restriction of Excessive Authentication Attempts","description":"This vulnerability arises because there are no limitations on the number\n of authentication attempts a user can make. An attacker can exploit \nthis weakness by continuously sending authentication requests, leading \nto a denial-of-service (DoS) condition. This can overwhelm the \nauthentication system, rendering it unavailable to legitimate users and \npotentially causing service disruption. This can also allow attackers to\n conduct brute-force attacks to gain unauthorized access.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00423,"percentile":0.37075,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-307"],"published":"2026-01-22T22:37:36Z","modified":"2026-06-17T09:39:12Z","products":[{"vendor":"evmapa","product":"evmapa"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-08","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-022-08.json","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53968"},{"url":"https://github.com/advisories/GHSA-g774-49mh-xqjp"}],"sources":{"cve":[{"id":"CVE-2025-53968","title":"EVMAPA Improper Restriction of Excessive Authentication Attempts","description":"This vulnerability arises because there are no limitations on the number\n of authentication attempts a user can make. An attacker can exploit \nthis weakness by continuously sending authentication requests, leading \nto a denial-of-service (DoS) condition. This can overwhelm the \nauthentication system, rendering it unavailable to legitimate users and \npotentially causing service disruption. This can also allow attackers to\n conduct brute-force attacks to gain unauthorized access.","status":"published","published":"2026-01-22T22:37:36.978Z","modified":"2026-01-23T20:11:29.349Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:32:49.180768Z"}],"euvd":[{"id":"EUVD-2026-4499","description":"This vulnerability arises because there are no limitations on the number\n of authentication attempts a user can make. An attacker can exploit \nthis weakness by continuously sending authentication requests, leading \nto a denial-of-service (DoS) condition. This can overwhelm the \nauthentication system, rendering it unavailable to legitimate users and \npotentially causing service disruption. This can also allow attackers to\n conduct brute-force attacks to gain unauthorized access.","status":"published","published":"2026-01-22T22:37:36Z","modified":"2026-01-23T20:11:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:47.68467Z"}],"ghsa":[{"id":"GHSA-g774-49mh-xqjp","title":"This vulnerability arises because there are no limitations on the number\n of authentication...","description":"This vulnerability arises because there are no limitations on the number\n of authentication attempts a user can make. An attacker can exploit \nthis weakness by continuously sending authentication requests, leading \nto a denial-of-service (DoS) condition. This can overwhelm the \nauthentication system, rendering it unavailable to legitimate users and \npotentially causing service disruption. This can also allow attackers to\n conduct brute-force attacks to gain unauthorized access.","status":"published","published":"2026-01-23T00:31:17Z","modified":"2026-01-23T00:31:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T15:05:52.452073Z"}],"nvd":[{"id":"CVE-2025-53968","description":"This vulnerability arises because there are no limitations on the number\n of authentication attempts a user can make. An attacker can exploit \nthis weakness by continuously sending authentication requests, leading \nto a denial-of-service (DoS) condition. This can overwhelm the \nauthentication system, rendering it unavailable to legitimate users and \npotentially causing service disruption. This can also allow attackers to\n conduct brute-force attacks to gain unauthorized access.","status":"published","published":"2026-01-22T23:15:49.8Z","modified":"2026-06-17T09:39:12.45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:11:59.073638Z"}]}}