CVE-2025-0637

Critical

Published: 23 January 2025

Published

23 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0025 48.3th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0637 is a critical-severity Improper Authentication (CWE-287) vulnerability in Incibe (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for access to private application areas like '/app/tools.html', directly preventing unauthenticated exploitation.

AC-24 Access Control Decisions good match

prevent

Requires the system to make explicit access control decisions for resources based on roles, addressing the lack of authorization checks in multiple application areas.

AC-6 Least Privilege partial match

prevent

Limits access to only essential privileges for specific roles, mitigating unauthorized entry into areas intended for privileged users.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Direct remote exploitation of public-facing web app via improper authorization / access control bypass (CWE-287) with no authentication required.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to access private areas and/or areas intended for other roles.…

The vulnerability has been identified at least in the file or path ‘/app/tools.html’.

Deeper analysisAI

CVE-2025-0637 is an improper authorization vulnerability (CWE-287) in the Beta10 software, where multiple areas of the application lack proper access controls. This deficiency allows unauthorized access to private areas or sections intended for specific roles, with the issue identified at least in the path '/app/tools.html'. The vulnerability received a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-01-23.

A remote attacker requires no authentication, privileges, or user interaction to exploit this over the network with low complexity. Successful exploitation grants the malicious actor access to restricted areas, enabling high-impact compromise of confidentiality, integrity, and availability as indicated by the CVSS metrics.

The INCIBE-CERT advisory provides further details on the inadequate access control issue in Beta10 at https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-beta10.