CVE-2025-59090
Published: 26 January 2026
Summary
CVE-2025-59090 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Sec Consult (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 40.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206366
Vulnerability details
On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events…
more
as well as querying the 2FA PINs associated with the enrolled chip cards.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.
Tailoring replaces or augments insecure default initializations with system-specific values and compensating controls before deployment.
Tools routinely check for missing authentication on critical functions and exposed interfaces.
Training emphasizes enabling and properly using authentication for critical functions, reducing missing authentication exposures.
Secure configuration documentation explicitly addresses enabling authentication for critical functions, reducing missing authentication exposures.
Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.