CVE-2025-26201
Published: 24 February 2025
Summary
CVE-2025-26201 is a critical-severity Authentication Bypass by Capture-replay (CWE-294) vulnerability in Greaterwms (inferred from references). Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
GreaterWMS versions up to and including 2.1.49 contain a credential disclosure vulnerability that is reachable via the /staff route. The flaw permits remote, unauthenticated access to sensitive credential material, directly enabling authentication bypass and subsequent privilege escalation. The issue is tracked as CVE-2025-26201 with a CVSS 3.1 base score of 9.1 and is associated with CWE-294.
An attacker with network access can send crafted requests to the affected endpoint and obtain credentials without supplying any authentication tokens. Successful exploitation grants the attacker the ability to impersonate staff accounts and perform actions that would normally require elevated privileges within the warehouse-management application.
The EPSS score for the vulnerability rose from a low baseline to a recorded peak of 0.0101 before settling at the current value of 0.0052, indicating a measurable increase in observed exploitation interest after public disclosure. Public references include the vendor site, a detailed technical write-up, and an associated GitHub issue, though no official patch or mitigation guidance is provided in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4288
Vulnerability details
Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attackers to bypass authentication and escalate privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated exploitation of public-facing web app (/staff) for auth bypass and privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification, reporting, and timely correction of the specific flaw in GreaterWMS <=2.1.49 that enables credential disclosure via the /staff route.
Enforces approved authorizations to block unauthenticated remote access to the vulnerable /staff route, preventing authentication bypass and privilege escalation.
Limits damage from disclosed staff credentials by restricting privileges to the minimum necessary, mitigating escalation impact.