CVE-2025-53968
Published: 22 January 2026
Summary
CVE-2025-53968 is a high-severity Improper Restriction of Excessive Authentication Attempts (CWE-307) vulnerability in Evmapa Evmapa. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 30.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-7 (Unsuccessful Logon Attempts) and SC-5 (Denial-of-service Protection).
Deeper analysis
CVE-2025-53968, published on 2026-01-22, is a high-severity vulnerability (CVSS 7.5; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) classified under CWE-307: Improper Restriction of Excessive Authentication Attempts. It affects authentication systems that impose no limitations on the number of authentication attempts a user can make, as detailed in CISA's ICS advisory ICSA-26-022-08.
Remote unauthenticated attackers can exploit this vulnerability by continuously sending authentication requests, triggering a denial-of-service (DoS) condition that overwhelms the authentication system and renders it unavailable to legitimate users, potentially causing broader service disruptions. The lack of rate limiting also enables brute-force attacks aimed at gaining unauthorized access.
For mitigation guidance, refer to the official advisories: CISA ICSA-26-022-08 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-08 and the corresponding CSAF JSON document at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-022-08.json.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4499
Vulnerability details
This vulnerability arises because there are no limitations on the number of authentication attempts a user can make. An attacker can exploit this weakness by continuously sending authentication requests, leading to a denial-of-service (DoS) condition. This can overwhelm the authentication…
more
system, rendering it unavailable to legitimate users and potentially causing service disruption. This can also allow attackers to conduct brute-force attacks to gain unauthorized access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Lack of rate limiting directly enables unlimited authentication attempts for brute force (T1110) and application-layer DoS via exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces limits on consecutive unsuccessful logon attempts, preventing both brute-force attacks and DoS from excessive authentication requests specific to this CVE.
Provides comprehensive denial-of-service protections tailored to flooding attacks on the authentication system as exploited in this CVE.
Mitigates resource exhaustion DoS caused by continuous authentication requests overwhelming system resources in this CVE.