CVE-2025-52395
Published: 21 August 2025
Summary
CVE-2025-52395 is a critical-severity Improper Authentication (CWE-287) vulnerability in Roadcube (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-8 (Identification and Authentication (Non-organizational Users)).
Deeper analysis
CVE-2025-52395 is a critical vulnerability affecting Roadcute API version 1, published on 2025-08-21. The issue stems from the application's password reset API endpoint, which exposes functionality without properly validating the identity of the requester, as classified under CWE-287 (Improper Authentication). This flaw enables remote arbitrary code execution and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A remote attacker requires no privileges, authentication, or user interaction to exploit the vulnerability over the network with low attack complexity. By targeting the inadequately validated password reset endpoint, the attacker can achieve arbitrary code execution, resulting in high impacts to confidentiality, integrity, and availability on the affected system.
Advisories and additional details are available in the referenced sources, including the GitHub repository at https://github.com/Arakiba/CVEs/tree/main/CVE-2025-52395 and the vendor site at https://www.roadcube.com/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25451
Vulnerability details
An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes unauthenticated RCE against a public password reset API endpoint, directly matching exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access to the password reset API endpoint, directly preventing exploitation by unauthorized remote requesters.
Enforces access protections for publicly accessible endpoints like the password reset API, mitigating unauthenticated access that enables arbitrary code execution.
Mandates identification and authentication for non-organizational users accessing the API, addressing the core improper validation of requester identity.