CVE-2025-0482
Native-Php-Cms Project Native-Php-Cms 1.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-0482 is a medium-severity Use of Default Credentials (CWE-1392) vulnerability in Native-Php-Cms Project Native-Php-Cms. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-0482 is a vulnerability classified as critical in Fanli2012 native-php-cms version 1.0, affecting an unknown part of the file /fladmin/user_recoverpwd.php. The issue stems from the use of default credentials, as detailed in the CVE description published on 2025-01-15. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-1392 and NVD-CWE-Other.
The vulnerability enables remote attackers with no privileges or user interaction to exploit the affected endpoint through manipulation, potentially leveraging default credentials for unauthorized access. Successful exploitation could result in low-level impacts to confidentiality, integrity, and availability.
Advisories reference GitHub issues at https://github.com/Fanli2012/native-php-cms/issues/4 and https://github.com/Fanli2012/native-php-cms/issues/4#issue-2769866348, along with VulDB entries including https://vuldb.com/?ctiid.291927, https://vuldb.com/?id.291927, and https://vuldb.com/?submit.475237. The exploit has been publicly disclosed and may be used.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1705
Vulnerability Data
A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file /fladmin/user_recoverpwd.php. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The exploit…
more
has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V13.2.1
Mitigating Controls (NIST 800-53 r5) AI
Secure configuration settings establish baselines that prohibit default credentials on system components.
Authenticator management requires verification of identity and secure distribution of initial authenticators, directly stopping default credentials from being left in place.
Vulnerability scanning can discover default credentials after deployment but does not stop their introduction.
Account management processes include assignment and control of initial account credentials, reducing the chance defaults remain active.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened baselines and configuration management explicitly prohibit default credentials on deployed systems.
Credential management processes directly require replacing or disabling default passwords and keys.
Authentication policies can enforce non-default credential strength but do not explicitly address initial deployment defaults.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The requirement to replace vendor default authentication information immediately after installation directly counters the use of default credentials that attackers commonly target.