CVE-2025-25570
Published: 27 February 2025
Summary
CVE-2025-25570 is a critical-severity Insufficiently Protected Credentials (CWE-522) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and IA-5 (Authenticator Management).
Deeper analysis
Vue Vben Admin version 2.10.1 contains a vulnerability that permits unauthorized login to the administrative backend because of hardcoded credentials. The issue is tracked as CVE-2025-25570 with a CVSS 3.1 base score of 9.8 and is associated with CWE-522 and CWE-798.
An unauthenticated attacker can exploit the flaw over the network without any user interaction or privileges to obtain full read, write, and administrative control over the backend application. Successful exploitation results in complete compromise of confidentiality, integrity, and availability.
The two provided references point only to a GitHub repository and contain no advisory text, patch details, or mitigation guidance.
EPSS for the CVE rose from an initially low value to a peak of 0.4593 on 2026-02-03 before receding to the current score of 0.2057, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5494
Vulnerability details
Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hardcoded credentials enable remote unauthorized access to the public-facing admin interface (T1190) by abusing embedded valid/default credentials (T1078.001) for initial access without authentication.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
IA-5 mandates proper management of authenticators including changing defaults and protecting from unauthorized disclosure, directly preventing hardcoded credentials that enable unauthorized backend login.
AC-2 requires management of accounts including disabling unnecessary or default accounts, mitigating hardcoded credential accounts in Vue Vben Admin.
SI-2 requires timely identification and remediation of flaws such as hardcoded credentials, preventing exploitation of this authentication bypass vulnerability.