by Kastro
Paper/Archive/CVE-2025-11899

CVE-2025-11899

Flowring Technology Agentflow — Flowring Technology｜Agentflow - Use of Hard-coded Cryptographic Key

EPSS 0.7%CVSS 9.2
critical.is priorityof 100
38
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 52.2.522 × 2010.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information, thereby logging into the system as any user. Attacker must first obtain an user ID in order to exploit this vulnerability.

Affected

ProductAffectedFixed inSource
Agentflow4.0–CNA

Scores by source

twcert (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
twcert (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10438-1173e-1.htmlwriteuptwcert.org.tw/en/cp-139-10439-0bd15-2.html