Cyber Resilience

CVE-2025-40716

Critical

Published: 08 July 2025

Published
08 July 2025
Modified
18 October 2025
KEV Added
—
Patch
—
CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0024 47.6th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-40716 is a critical-severity SQL Injection (CWE-89) vulnerability in Quiter Quiter Gateway. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-40716 is a SQL injection vulnerability (CWE-89) in Quiter Gateway by Quiter, affecting versions prior to 4.7.0. The issue exists in the suceso.contenido mensaje parameter of the /QMSCliente/Sucesos.action endpoint, which allows attackers to retrieve, create, update, and delete databases.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network by any unauthenticated attacker with low attack complexity and no user interaction. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, permitting arbitrary database manipulation.

The INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter covers this and other vulnerabilities in QuiterWeb, Autoweb, and Quiter products. Mitigation requires upgrading to Quiter Gateway version 4.7.0 or later, where the vulnerability is addressed.

EU & UK References

Vulnerability details

SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the suceso.contenido mensaje in /QMSCliente/Sucesos.action.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in unauthenticated public-facing web endpoint directly enables remote exploitation of the application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-40714Same product: Quiter Quiter Gateway
CVE-2025-40713Same product: Quiter Quiter Gateway
CVE-2025-40715Same product: Quiter Quiter Gateway
CVE-2025-40717Same product: Quiter Quiter Gateway
CVE-2025-40711Same product: Quiter Quiter Gateway
CVE-2025-40712Same product: Quiter Quiter Gateway
CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89

Affected Assets

quiter
quiter gateway
≤ 4.7.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates SQL injection by validating the suceso.contenido mensaje parameter in /QMSCliente/Sucesos.action to reject malicious SQL payloads.

SI-2 Flaw Remediation good match
prevent

Remediates the root SQL injection flaw by identifying, patching, and upgrading Quiter Gateway to version 4.7.0 or later.

SC-7 Boundary Protection partial match
preventdetect

Boundary protection via web application firewalls monitors and blocks SQL injection attempts targeting the vulnerable endpoint.

References