CVE-2025-8742
Published: 08 August 2025
Summary
CVE-2025-8742 is a medium-severity Improper Restriction of Excessive Authentication Attempts (CWE-307) vulnerability in Macrozheng Mall. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Password Guessing (T1110.001); ranked in the top 41.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24020
Vulnerability details
A vulnerability was found in macrozheng mall 1.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Admin Login. The manipulation leads to improper restriction of excessive authentication attempts. The attack may…
more
be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unrestricted excessive authentication attempts on admin login, enabling brute force password guessing (T1110.001) as confirmed by VulDB mapping.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
This control directly enforces limits on consecutive invalid logon attempts and automatic response (e.g., lockout) to prevent brute-force exploitation of authentication mechanisms.
Specific conditions can include excessive failed attempts, triggering stronger authentication that restricts brute-force exploitation.
The control requires defining frequency, timing, and approval for security interactions, directly addressing uncontrolled interaction rates.
Allocation policies inherently restrict interaction frequency, reducing the impact of excessive requests.
Spam protection explicitly controls interaction frequency by detecting and acting on bulk unsolicited messages from external sources.