CVE-2025-1387
Published: 17 February 2025
Summary
CVE-2025-1387 is a critical-severity Weak Authentication (CWE-1390) vulnerability in Learningdigital Orca Hcm. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked in the top 30.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires systems to uniquely identify and authenticate organizational users before granting access, directly preventing unauthenticated attackers from logging in as any user.
Explicitly identifies and authorizes only specific actions without identification or authentication, prohibiting unauthenticated logins to the system.
Enforces approved access authorizations in accordance with policy, ensuring logical access requires proper authentication and mitigating impersonation vulnerabilities.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct auth bypass on public-facing HCM app enables use of valid accounts (T1078) via exploitation of remote application (T1190).
NVD Description
Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user.
Deeper analysisAI
CVE-2025-1387, published on 2025-02-17, is an Improper Authentication vulnerability (CWE-1390) affecting Orca HCM, a human capital management system from LEARNING DIGITAL. The flaw enables unauthenticated remote attackers to log in to the system as any user, bypassing normal authentication controls. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity due to network vector, low complexity, no privileges or user interaction required, and high impacts across confidentiality, integrity, and availability.
Any unauthenticated remote attacker can exploit this vulnerability by targeting the affected Orca HCM instance over the network. Successful exploitation grants the attacker the ability to impersonate any user account, potentially allowing full administrative access, data exfiltration, system modification, or service disruption depending on the targeted user's privileges.
Advisories from TWCERT/CC detail mitigation steps and are available at https://www.twcert.org.tw/en/cp-139-8428-59a9a-2.html and https://www.twcert.org.tw/tw/cp-132-8427-daea8-1.html.
Details
- CWE(s)