CVE-2025-59101
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-59101 is a high-severity Reliance on IP Address for Authentication (CWE-291) vulnerability in Sec Consult (inferred from references). Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Trusted Relationship (T1199); ranked in the top 49% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-8 (Identification and Authentication (Non-organizational Users)) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206365
Vulnerability Data
Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address…
more
is handled as authenticated. No other session information is stored. Therefore, it is possible to spoof the IP address of a logged-in user to gain access to the Access Manager web interface.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires unique identification and authentication of users rather than permitting unauthenticated or spoofable attributes such as source IP.
Requires unique identification and authentication of non-organizational users, precluding reliance on IP address alone.
Mandates documented usage restrictions and configuration requirements for remote access that cannot be satisfied by IP-based authentication.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Strong authentication mechanisms directly replace reliance on spoofable IP addresses.
Managed identities and credentials supplant weak IP-based authentication decisions.
Network monitoring can detect misuse of IP authentication but does not prevent the weakness.
Authorization policies and least privilege reduce dependence on network-location assertions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure-authentication control directly addresses the weakness by requiring proper credentials instead of IP address.
Access-control policy can mandate stronger authentication than IP address alone.
Identity-management processes should replace IP-based identification with verified identities.
Authentication-information rules discourage reliance on mutable attributes such as IP addresses.
Access-rights assignment should be tied to authenticated identities, not network location.
Privileged-access rules require authenticated users rather than implicit IP trust.