Raw vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-2311 is a critical-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Gov (inferred from references). Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-2311 is a vulnerability involving incorrect use of privileged APIs, cleartext transmission of sensitive information, and insufficiently protected credentials in SecHard from Sechard Information Technologies. It affects versions of SecHard prior to 3.3.0.20220411 and enables authentication bypass, interface manipulation, authentication abuse, and harvesting information via API event monitoring. The vulnerability is associated with CWE-319 (cleartext transmission of sensitive information), CWE-522 (insufficiently protected credentials), and CWE-648 (incorrect use of privileged APIs), earning a CVSS v3.1 base score of 9.0.
Attackers can exploit this vulnerability over an adjacent network (AV:A) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N). Successful exploitation changes the scope (S:C) and results in high impacts to confidentiality, integrity, and availability (C:I:A:H), allowing adversaries with initial low-level access to bypass authentication mechanisms, manipulate the interface, abuse authentication processes, and harvest sensitive information through API event monitoring.
Mitigation involves upgrading to SecHard version 3.3.0.20220411 or later, as the issue affects only prior versions. Additional details are available in the advisory at https://www.usom.gov.tr/bildirim/tr-25-0074.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6806
Vulnerability Data
Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harvesting Information via API Event Monitoring. This issue affects SecHard: before 3.3.0.20220411.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
V11.3.3V3.5.2V6.4.6
Mitigating Controls (NIST 800-53 r5) AI
Protection of information at rest requires encryption or equivalent safeguards for stored credentials.
SC-8 directly requires protecting confidentiality of transmitted information, which structurally eliminates cleartext transmission of sensitive data.
Developer testing and evaluation can discover incorrect calls to privileged APIs before deployment.
Enforces authorization checks around privileged operations so that an API requiring elevated rights cannot be reached or misused without proper rights.
Least-privilege assignment directly reduces both the availability of privileged APIs and the blast radius when they are invoked incorrectly.
Authenticator management requires secure generation, storage, and distribution of credentials, directly stopping insecure methods.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encrypting data-at-rest fully prevents insecure credential storage while only partially satisfying the broader data-protection outcome.
Encryption of data-in-transit directly prevents cleartext transmission while the control also addresses integrity and availability.
Credential management practices directly reduce insecure storage/transmission but do not guarantee encryption or transport protection.
Protecting identity assertions covers conveyance of credentials but is narrower than full credential lifecycle protection.
Secure SDLC practices directly enforce correct usage of privileged APIs during development.
Authentication policies can enforce stronger credential handling yet address only verification, not storage or transit protection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring protected storage, transmission, and non-display of passwords prevents credentials from being stored or sent in clear text where they can be harvested by unauthorized actors.
Specifying encryption and other security technology for network services prevents transmission of sensitive information in cleartext over potentially untrusted channels.
Protecting secret and private keys against disclosure and unauthorized use decreases the exposure of credentials that are stored or transmitted in recoverable form.
Security testing can detect incorrect privileged API calls but does not prevent them at design time.
Forbidding clear-text transmission and display of passwords, plus the use of stronger alternatives to passwords, prevents credentials from being obtained or reused by attackers.
Acceptable-use expectations that cover protection of credentials and information assets throughout their lifecycle discourage practices that expose or mishandle authentication material.