CVE-2025-0352
Published: 20 February 2025
Summary
CVE-2025-0352 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Cisa (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-16 (Security and Privacy Attributes).
Deeper analysis
CVE-2025-0352 is a vulnerability in the API used by the Rapid Response Monitoring My Security Account App. An attacker can exploit the API by modifying request data, which may cause it to return information about other users. Published on 2025-02-20, the issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is linked to CWE-639 (Authorization Bypass Through User-Controlled Key).
The vulnerability enables remote, unauthenticated attackers to exploit it over the network with low complexity and no user interaction required. Successful exploitation results in high-impact confidentiality violations, allowing access to other users' information without affecting integrity or availability.
Mitigation guidance is available in CISA ICS Advisory ICSA-25-051-05 at https://www.cisa.gov/news-events/ics-advisories/icsa-25-051-05. Additional support can be obtained by contacting Rapid Response Monitoring at https://www.rrms.com/contact-us/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4565
Vulnerability details
Rapid Response Monitoring My Security Account App utilizes an API that could be exploited by an attacker to modify request data, potentially causing the API to return information about other users.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct exploitation of public-facing API via IDOR/authz bypass (CWE-639) for unauthorized data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for access to information, directly preventing the API from returning other users' data despite modified request parameters.
SI-10 validates API request inputs to block or reject tampered data that could lead to unauthorized information disclosure.
AC-16 uses security attributes to enforce access controls, mitigating bypass attempts via user-controlled keys in API requests.