CVE-2025-34509

Estado: ModificadaAlta (7.5)—

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 56%
Percentil entre todas las CVEs puntuadas: 99
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access90 %
Impacto principalT1078.001 Default Accountsstealth · persistence · privilege escalation · initial access85 %

Credencial hardcoded (CWE-798) accesible remotamente sin autenticación previa permite acceso a API administrativa. AV:N/PR:N/UI:N define explotación web T1190; acceso con cuenta válida es T1078.001.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Privileged Account Management Password Policies Network Segmentation Multi-factor Authentication Limit Access to Resource Over Network

Tecnologías afectadas (4)

Sitecore — Experience Commerce Sitecore — Experience Manager Sitecore — Experience Platform Sitecore — Managed Cloud

CWE

CWE-798

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-34509",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-34509",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-18T03:56:10.468989Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "Sitecore",
          "product": "Experience Manager",
          "versions": [
            {
              "status": "affected",
              "version": "10.4",
              "lessThan": "10.4.1 rev. 011941 PRE",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.3",
              "lessThan": "10.3.3 rev. 011967 PRE",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.1",
              "lessThan": "10.1.4 rev. 011974 PRE",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sitecore",
          "product": "Experience Platform",
          "versions": [
            {
              "status": "affected",
              "version": "10.4",
              "lessThan": "10.4.1 rev. 011941 PRE",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.3",
              "lessThan": "10.3.3 rev. 011967 PRE",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.1",
              "lessThan": "10.1.4 rev. 011974 PRE",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-06-17T19:15:31.423",
  "references": [
    {
      "url": "https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP."
    },
    {
      "lang": "es",
      "value": "Sitecore Experience Manager (XM) y Experience Platform (XP) versiones 10.1 a 10.1.4 rev. 011974 PRE, todas las versiones 10.2, 10.3 a 10.3.3 rev. 011967 PRE y 10.4 a 10.4.1 rev. 011941 PRE contienen una cuenta de usuario codificada. Atacantes remotos no autenticados pueden usar esta cuenta para acceder a la API administrativa a través de HTTP."
    }
  ],
  "lastModified": "2026-06-17T09:14:03.087",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCF77DC5-9DF9-4DF7-9636-69CA4BEEDB04",
              "versionEndIncluding": "10.4",
              "versionStartIncluding": "9.0"
            },
            {
              "criteria": "cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17EF29D0-E1DA-4F84-95F4-EA9680EB47DF",
              "versionEndIncluding": "10.4",
              "versionStartIncluding": "9.0"
            },
            {
              "criteria": "cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88455751-A525-4A59-9DD8-4E015CD1346C",
              "versionEndExcluding": "10.4",
              "versionStartIncluding": "9.0"
            },
            {
              "criteria": "cpe:2.3:a:sitecore:experience_platform:10.4:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78E71AD1-04C7-4D80-9A0A-E386A3FAC860"
            },
            {
              "criteria": "cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "520CF670-01A2-479F-B637-C413A82463E0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com"
}