{"id":"CVE-2025-54816","aliases":["EUVD-2026-4500","GHSA-fpfh-v96r-h7v9"],"status":"published","title":"EVMAPA Missing Authentication for Critical Function","description":"This vulnerability occurs when a WebSocket endpoint does not enforce \nproper authentication mechanisms, allowing unauthorized users to \nestablish connections. As a result, attackers can exploit this weakness \nto gain unauthorized access to sensitive data or perform unauthorized \nactions. Given that no authentication is required, this can lead to \nprivilege escalation and potentially compromise the security of the \nentire system.","severity":{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00469,"percentile":0.41065,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2026-01-22T22:40:55Z","modified":"2026-06-17T09:40:45Z","products":[{"vendor":"evmapa","product":"evmapa"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-08","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-022-08.json","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54816"},{"url":"https://github.com/advisories/GHSA-fpfh-v96r-h7v9"}],"sources":{"cve":[{"id":"CVE-2025-54816","title":"EVMAPA Missing Authentication for Critical Function","description":"This vulnerability occurs when a WebSocket endpoint does not enforce \nproper authentication mechanisms, allowing unauthorized users to \nestablish connections. As a result, attackers can exploit this weakness \nto gain unauthorized access to sensitive data or perform unauthorized \nactions. Given that no authentication is required, this can lead to \nprivilege escalation and potentially compromise the security of the \nentire system.","status":"published","published":"2026-01-22T22:40:55.625Z","modified":"2026-01-23T20:12:02.94Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:32:27.28543Z"}],"euvd":[{"id":"EUVD-2026-4500","description":"This vulnerability occurs when a WebSocket endpoint does not enforce \nproper authentication mechanisms, allowing unauthorized users to \nestablish connections. As a result, attackers can exploit this weakness \nto gain unauthorized access to sensitive data or perform unauthorized \nactions. Given that no authentication is required, this can lead to \nprivilege escalation and potentially compromise the security of the \nentire system.","status":"published","published":"2026-01-22T22:40:55Z","modified":"2026-01-23T20:12:02Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T19:48:47.68467Z"}],"ghsa":[{"id":"GHSA-fpfh-v96r-h7v9","title":"This vulnerability occurs when a WebSocket endpoint does not enforce \nproper authentication...","description":"This vulnerability occurs when a WebSocket endpoint does not enforce \nproper authentication mechanisms, allowing unauthorized users to \nestablish connections. As a result, attackers can exploit this weakness \nto gain unauthorized access to sensitive data or perform unauthorized \nactions. Given that no authentication is required, this can lead to \nprivilege escalation and potentially compromise the security of the \nentire system.","status":"published","published":"2026-01-23T00:31:17Z","modified":"2026-01-23T00:31:17Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:05:52.452073Z"}],"nvd":[{"id":"CVE-2025-54816","description":"This vulnerability occurs when a WebSocket endpoint does not enforce \nproper authentication mechanisms, allowing unauthorized users to \nestablish connections. As a result, attackers can exploit this weakness \nto gain unauthorized access to sensitive data or perform unauthorized \nactions. Given that no authentication is required, this can lead to \nprivilege escalation and potentially compromise the security of the \nentire system.","status":"published","published":"2026-01-22T23:15:49.953Z","modified":"2026-06-17T09:40:45.68Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:11:59.073638Z"}]}}