CVE-2025-69615

Critical

Published: 10 March 2026

Published

10 March 2026

Modified

07 May 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0001 3.4th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-69615 is a critical-severity Improper Restriction of Excessive Authentication Attempts (CWE-307) vulnerability in Telekom Account Management Portal. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 3.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-7 (Unsuccessful Logon Attempts) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Brute Force (T1110). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-7 Unsuccessful Logon Attempts good match

prevent

AC-7 directly mandates limits on consecutive unsuccessful logon attempts and account locking, preventing unlimited brute-force retries on the 2FA mechanism.

SI-2 Flaw Remediation good match

prevent

SI-2 requires timely identification, reporting, and patching of flaws like the missing 2FA rate-limiting, directly addressing the code vulnerability via software updates.

IA-5 Authenticator Management partial match

prevent

IA-5 ensures authenticator management with sufficient strength of mechanism for 2FA, mitigating brute-force risks through secure handling and refresh of multi-factor authenticators.

MITRE ATT&CK Enterprise TechniquesAI

T1110 Brute Force Credential Access

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.

attack.mitre.org →

Why these techniques?

Missing rate limits directly enable unlimited brute-force guessing of 2FA codes (T1110), resulting in MFA bypass and unauthorized account access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-24, fixed 2025-11-03.

Deeper analysisAI

CVE-2025-69615 is an incorrect access control vulnerability (CWE-307) stemming from missing rate-limiting on two-factor authentication (2FA) in the Deutsche Telekom AG Telekom Account Management Portal. This flaw allows unlimited brute-force retries on 2FA, enabling full multi-factor authentication (MFA) bypass without any user interaction. It affects versions of the portal prior to the update on 2025-10-24, with a fix applied on 2025-11-03. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to high impacts on confidentiality and integrity.

Remote attackers require no privileges or user interaction to exploit this issue over the network with low complexity. By repeatedly attempting brute-force guesses against the 2FA mechanism without rate limits, adversaries can fully bypass MFA protections, gaining unauthorized access to affected user accounts in the Telekom Account Management Portal and potentially compromising sensitive account data.

Mitigation requires updating the Telekom Account Management Portal to the version incorporating the fix released on 2025-11-03. Additional details are available in Telekom's security acknowledgements at https://www.telekom.com/en/company/data-privacy-and-security/news/acknowledgements-358300#R and a technical gist at https://gist.github.com/ethicalrohitt/b3e6d071aac8530459e8b3a5720bb832. The CVE was published on 2026-03-10T18:18:01.740.