CVE-2025-7016
Akinsoft Qr Menu ≤ s1.05.12
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-7016 is a high-severity Improper Access Control (CWE-284) vulnerability in Akinsoft Qr Menu. Its CVSS base score is 8.0 (High).
Operationally, ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-7016 is an Improper Access Control vulnerability in the QR Menu software developed by Akın Software Computer Import Export Industry and Trade Ltd. The flaw enables Authentication Abuse and affects all versions of QR Menu prior to s1.05.12. It has been assigned a CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-284 (Improper Access Control) as well as NVD-CWE-Other.
An attacker with low privileges can exploit this vulnerability over the network with low complexity, though it requires user interaction. Successful exploitation grants high impacts on confidentiality, integrity, and availability, potentially allowing the attacker to abuse authentication mechanisms and gain unauthorized access to sensitive functions or data within the QR Menu application.
The advisory at https://www.usom.gov.tr/bildirim/tr-26-0006 provides details on the vulnerability. Mitigation involves updating to QR Menu version s1.05.12 or later, as the issue is fixed in that release.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206549
Vulnerability Data
Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse. This issue affects QR Menu: before s1.05.12.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for logical access, stopping unauthorized actors from reaching resources.
Enforces flow-control policies that restrict information movement between subjects and objects.
Documents duties and assigns access so that no single account can bypass intended restrictions.
Limits each account to the minimum privileges needed, reducing the chance of unauthorized access.
Defines account types, assigns/removes access, and reviews accounts to ensure only authorized actors can reach resources.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 directly mandates determining requirements, defining/implementing topic-specific access control policy+rules (with explicit references to 8.3, 5.16, 5.18), and enforcing authorized access while preventing unauthorized access, which squarely stops exploitation of most CWE-284 instances; the bounded remainder is the physical slice (explicitly delegated to 7.2-7.4) plus any second-order defects like path traversal that are not authorization decisions.
A.5.16's identity lifecycle (unique binding, timely disable/remove, no duplicates, oversight of shared/non-human) directly stops most improper access by ensuring the actor in an access decision is correctly identified and authorized; the bounded remainder is non-identity mechanisms in CWE-284 such as path traversal or CSRF that do not turn on actor identity at all.
A.5.18 directly governs the provisioning, review, adjustment and timely revocation of both physical and logical access rights per business rules, segregation of duties and risk-evaluated changes/terminations; this stops most unauthorized-actor exploitation paths named by CWE-284, with a bounded remainder (e.g. path-traversal or CSRF cases that are not authorization decisions at all)
A.6.7's policy, rules, mechanisms, authentication requirements, remote access controls, network restrictions, and device measures (e.g. screen locks, firewalls, malware protection) directly stop unauthorized actors from exploiting improper access control in remote settings; remainder is non-remote or physical-only slices of CWE-284 (as in AC-3's own mostly precedent).
A.8.1 mandates access controls, storage encryption, software restrictions, malware protection, remote lock/wipe, physical/logical device protections, and policy-driven enforcement that stop unauthorized actors from exploiting improper access control on endpoints; remainder is non-endpoint or non-device slices of CWE-284 (e.g. server-side authorization logic).
A.8.2 directly controls allocation, review, expiry, temporary use, separate identities and heightened authentication for privileged rights per the access policy, which stops most improper-access-control exploitation paths for privileged resources; the bounded remainder is non-privileged improper access control (e.g. ordinary user rights, path traversal, CSRF).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.