CVE-2025-1214
Published: 12 February 2025
Summary
CVE-2025-1214 is a medium-severity Missing Authorization (CWE-862) vulnerability in Pihome Maxair. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 32.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-1214 is a critical vulnerability in pihome-shc PiHome 2.0, affecting an unknown part of the file /user_accounts.php?uid within the Role-Based Access Control component. The issue stems from missing authorization, mapped to CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization). It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-02-12.
The vulnerability enables remote exploitation by an attacker possessing low privileges, such as a low-privileged authenticated user. With low attack complexity and no requirement for user interaction, successful exploitation results in limited impacts: low confidentiality (C:L), integrity (I:L), and availability (A:L) effects.
Reference URLs point to VulDB advisories (vuldb.com/?ctiid.295173, vuldb.com/?id.295173, vuldb.com/?submit.497533) and GitHub repositories hosting published proof-of-concept exploits (github.com/janssensjelle/published-pocs/blob/main/pihomehvac-improper-access-control.md). These indicate public disclosure of the exploit, which may be used, though no specific patch or mitigation details are outlined in the provided information.
The exploit has been disclosed to the public, increasing the risk of active use against unpatched PiHome 2.0 instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2084
Vulnerability details
A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /user_accounts.php?uid of the component Role-Based Access Control. The manipulation leads to missing authorization. It is possible to initiate the attack…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) in /user_accounts.php allows authenticated users to create admin accounts without privilege checks, enabling exploitation for privilege escalation (T1068) and unauthorized account creation (T1136).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access to resources like the /user_accounts.php?uid endpoint, directly addressing the missing authorization in the RBAC component.
Requires explicit authorization decisions for access to system objects such as user accounts, mitigating CWE-862/863 improper authorization flaws exploitable by low-privileged remote users.
Applies least privilege to restrict low-privileged (PR:L) users from unauthorized manipulation of user accounts, preventing exploitation of the RBAC vulnerability.