CVE-2025-2218
Published: 12 March 2025
Summary
CVE-2025-2218 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Lovecards Lovecards. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-2218 is a critical vulnerability in LoveCards LoveCardsV2 versions up to 2.3.2, affecting unknown code in the /api/system/other endpoint of the Setting Handler component. It stems from improper access controls (CWE-266, CWE-284), enabling remote manipulation. The issue was published on 2025-03-12 with a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), indicating medium severity despite the critical classification.
Unauthenticated attackers can exploit this remotely over the network with low complexity and no user interaction required. Successful exploitation results in a low-impact integrity violation, allowing limited modification of data or behavior due to the access control bypass. A public exploit has been disclosed and is available for use.
Advisories from VulDB (ctiid.299290, id.299290) and a detailed write-up on a Notion site document the unauthenticated vulnerability, including a path from initial access to potential RCE. The vendor was notified early but provided no response, and no patches or mitigations are available as of publication. Security practitioners should isolate or decommission affected instances and monitor for exploitation attempts.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7552
Vulnerability details
A vulnerability has been found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This vulnerability affects unknown code of the file /api/system/other of the component Setting Handler. The manipulation leads to improper access controls. The attack can be…
more
initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated access control bypass in a public-facing API endpoint (/api/system/other), directly enabling exploitation of public-facing applications as described in T1190. The remote manipulation and path to potential RCE align with this initial access technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access to system resources, directly addressing the improper access controls in the /api/system/other endpoint allowing unauthenticated manipulation.
Identifies and limits permitted actions without identification or authentication, preventing unauthorized remote access to sensitive Setting Handler functions.
Applies least privilege to restrict necessary access, mitigating the impact of access control bypasses on data integrity.