CVE-2025-22918
Published: 03 February 2025
Summary
CVE-2025-22918 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-22918 affects Polycom RealPresence Group 500 devices running version 20 or earlier. The vulnerability stems from insecure permissions caused by automatically loaded cookies, which enable unauthorized access to administrator functions. This issue, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no requirements for authentication or user interaction.
Attackers can exploit this vulnerability remotely over the network without privileges. By leveraging the insecure cookie handling, unauthenticated remote actors gain access to admin-level functions, resulting in the leakage of sensitive user information. No integrity or availability impacts are associated with successful exploitation.
Advisories reference a GitHub repository at https://github.com/MinggongKs/Polycom/blob/main/README.md for further details, though specific mitigation or patch information is not detailed in the CVE publication from February 3, 2025.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3049
Vulnerability details
Polycom RealPresence Group 500 <=20 has Insecure Permissions due to automatically loaded cookies. This allows for the use of administrator functions, resulting in the leakage of sensitive user information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote unauthenticated exploitation of a public-facing web interface on Polycom RealPresence Group 500 devices via insecure cookie handling to gain admin access and leak sensitive information, directly mapping to T1190 Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly preventing unauthorized admin function use via insecure auto-loaded cookies.
Applies least privilege to restrict admin functions to only authorized users, mitigating privilege escalation from insecure cookie permissions.
Explicitly defines and limits actions performable without identification or authentication, blocking unauthenticated admin access enabled by cookies.