CVE-2025-25381
Published: 06 March 2025
Summary
CVE-2025-25381 is a high-severity Improper Access Control (CWE-284) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-25381 is an incorrect access control vulnerability (CWE-284) in the KSRTC AWATAR app version 1.3.0 of the Karnataka State Road Transport Corporation. The flaw enables unauthorized viewing of sensitive information, such as usernames and passwords. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility and low attack complexity.
The vulnerability can be exploited by any unauthenticated attacker with network access to the affected app, requiring no privileges or user interaction. Exploitation allows remote retrieval of sensitive credentials, potentially enabling further compromise of associated accounts or systems, though it does not impact integrity or availability.
Advisories providing further details, including potential mitigations or patches, are available at references such as https://github.com/advisories/GHSA-x2cr-cpw2-j9x5, https://github.com/edwin-0990/CVE_ID/blob/main/CVE-2025-25381/README.md, and https://www.tenable.com/cve/CVE-2025-25381. Security practitioners should review these sources for specific remediation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7670
Vulnerability details
Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information such as usernames and passwords.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an improper access control flaw in a network-accessible application allowing remote unauthenticated retrieval of credentials, directly enabling exploitation of public-facing applications (T1190) and access to unsecured credentials (T1552).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access to prevent unauthorized viewing of sensitive information like usernames and passwords in the app.
Limits permitted actions without identification or authentication, directly addressing unauthenticated access to sensitive credentials.
Applies least privilege to restrict access to sensitive data only to authorized users or processes, mitigating improper access control vulnerabilities.