CVE-2025-53118
Published: 25 August 2025
Summary
CVE-2025-53118 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-53118 by requiring timely identification, reporting, and correction of the authentication bypass flaw through patching.
Requires robust identification and authentication for organizational users, preventing unauthenticated access to administrator backup functions in the PAM system.
Enforces approved authorizations for access to sensitive backup controls, countering the authentication bypass vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Auth bypass in network-exposed PAM directly enables T1190 exploitation for credential access via T1552 from backups/tokens.
NVD Description
An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.
Deeper analysisAI
CVE-2025-53118 is an authentication bypass vulnerability (CWE-306) in Securden Unified PAM, a privileged access management solution. It enables an unauthenticated attacker to gain control over administrator backup functions, resulting in the compromise of stored passwords, secrets, and application session tokens. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and lack of prerequisites.
An unauthenticated remote attacker can exploit this flaw over the network with minimal effort, bypassing authentication to manipulate administrator backups. Successful exploitation grants high-level access to sensitive credentials and tokens, potentially enabling full compromise of the PAM system, lateral movement within the environment, and persistence through stolen secrets.
Rapid7's advisory details the fix for this and other critical vulnerabilities in Securden Unified PAM, recommending immediate application of patches provided by the vendor to mitigate the authentication bypass and prevent unauthorized backup control.
Details
- CWE(s)