CVE-2025-8861
Published: 29 August 2025
Summary
CVE-2025-8861 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Org (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-8861 is a missing authentication vulnerability (CWE-306) in TSA developed by Changing. This flaw allows unauthenticated remote attackers to read, modify, and delete database contents. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its network accessibility, low attack complexity, and high impacts across confidentiality, integrity, and availability.
Unauthenticated remote attackers can exploit CVE-2025-8861 over the network without requiring privileges or user interaction. Successful exploitation enables complete compromise of the affected database, including unauthorized data exfiltration, alteration, or destruction.
Mitigation details are available in advisories from TWCERT/CC, including https://www.twcert.org.tw/en/cp-139-10361-4ce04-2.html and https://www.twcert.org.tw/tw/cp-132-10360-012e7-1.html. Security practitioners should consult these for patching instructions and workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28806
Vulnerability details
TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on public-facing TSA app directly enables remote exploitation (T1190) for unauthorized database access/collection (T1213.006) and data manipulation (T1565.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 directly addresses missing authentication by defining and limiting permitted actions without identification or authentication, preventing unauthorized remote read, modify, and delete database operations.
IA-8 requires unique identification and authentication for non-organizational users, blocking unauthenticated remote attackers from compromising the database.
AC-3 enforces approved access control policies including authentication, mitigating the lack of enforcement that allows full database compromise.