CVE-2025-52395

Critical

Published: 21 August 2025

Published

21 August 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0082 74.5th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-52395 is a critical-severity Improper Authentication (CWE-287) vulnerability in Roadcube (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-8 (Identification and Authentication (Non-organizational Users)).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for logical access to the password reset API endpoint, directly preventing exploitation by unauthorized remote requesters.

SC-14 Public Access Protections good match

prevent

Enforces access protections for publicly accessible endpoints like the password reset API, mitigating unauthenticated access that enables arbitrary code execution.

IA-8 Identification and Authentication (Non-organizational Users) good match

prevent

Mandates identification and authentication for non-organizational users accessing the API, addressing the core improper validation of requester identity.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The CVE describes unauthenticated RCE against a public password reset API endpoint, directly matching exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly

Deeper analysisAI

CVE-2025-52395 is a critical vulnerability affecting Roadcute API version 1, published on 2025-08-21. The issue stems from the application's password reset API endpoint, which exposes functionality without properly validating the identity of the requester, as classified under CWE-287 (Improper Authentication). This flaw enables remote arbitrary code execution and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A remote attacker requires no privileges, authentication, or user interaction to exploit the vulnerability over the network with low attack complexity. By targeting the inadequately validated password reset endpoint, the attacker can achieve arbitrary code execution, resulting in high impacts to confidentiality, integrity, and availability on the affected system.

Advisories and additional details are available in the referenced sources, including the GitHub repository at https://github.com/Arakiba/CVEs/tree/main/CVE-2025-52395 and the vendor site at https://www.roadcube.com/.