CVE-2025-29994
Published: 13 March 2025
Summary
CVE-2025-29994 is a high-severity Weak Authentication (CWE-1390) vulnerability in Org (inferred from references). Its CVSS base score is 8.2 (High).
Operationally, ranked in the top 26.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
This vulnerability affects the CAP back office application and stems from an improper authentication check at an API endpoint, classified under CWE-1390. The flaw received a CVSS 4.0 score of 8.2 and was published on 2025-03-13.
An unauthenticated remote attacker who possesses a valid login ID can exploit the issue by manipulating input parameters in API request URLs or payloads, resulting in unauthorized access to other user accounts.
A technical advisory describing the issue is available from CERT-In at https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0048. The associated EPSS score remains low, with a current value of 0.0077 and a recorded peak of 0.0113.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6265
Vulnerability details
This vulnerability exists in the CAP back office application due to improper authentication check at the API endpoint. An unauthenticated remote attacker with a valid login ID could exploit this vulnerability by manipulating API input parameters through API request URL/payload…
more
leading to unauthorized access to other user accounts.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Helps detect exploitation of weak authentication mechanisms by notifying of previous unauthorized logons.
The IA policy requires strong authentication methods, reducing use of weak authentication.
Enforces dynamic, context-aware authentication that mitigates weak static authentication by increasing requirements based on risk or conditions.
Enforces authentication for users, reducing the viability of weak authentication mechanisms.
Requires authentication mechanisms to meet applicable standards and guidelines, preventing weak authentication.