« Volver al listado

CVE-2025-9062

Estado: AplazadaAlta (7.3)—

Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection.

This issue affects Envanty: before 1.0.6.

NOTE: The vendor was contacted early about this disclosure but did not respond in any way. The vulnerability was learned to be remediated through reporter information and testing.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Authorization bypass en aplicación de red adyacente (AV:A, PR:L) permite acceso no autorizado (T1078) y manipulación de datos (CWE-639: contraseña/credenciales controladas por usuario, impacta integridad I:H).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Mecode Informatics AND Engineering Services LTD — EnvantyAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-9062",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-9062",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-20T20:36:04.070089Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "iletisim@usom.gov.tr",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "iletisim@usom.gov.tr",
      "affectedData": [
        {
          "vendor": "MeCODE Informatics and Engineering Services Ltd.",
          "product": "Envanty",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.0.6",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-02-19T11:15:57.120",
  "references": [
    {
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0076",
      "source": "iletisim@usom.gov.tr"
    },
    {
      "url": "https://www.usom.gov.tr/bildirim/tr-26-0076",
      "source": "iletisim@usom.gov.tr"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "iletisim@usom.gov.tr",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection.\n\nThis issue affects Envanty: before 1.0.6.  \n\n\n\nNOTE: The vendor was contacted early about this disclosure but did not respond in any way. \nThe vulnerability was learned to be remediated through reporter information and testing."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de elusión de autorización a través de clave controlada por el usuario en MeCODE Informatics y Engineering Services Ltd. Envanty permite la inyección de parámetros. Este problema afecta a Envanty: antes de la versión 1.0.6.\n\nNOTA: Se contactó al proveedor con antelación sobre esta divulgación, pero no respondió de ninguna manera. Se supo que la vulnerabilidad fue remediada a través de información del informante y pruebas."
    }
  ],
  "lastModified": "2026-06-17T10:08:14.867",
  "sourceIdentifier": "iletisim@usom.gov.tr"
}