by Kastro
Paper/Archive/CVE-2025-15016

CVE-2025-15016

Ragic Enterprise Cloud Database — Ragic｜Enterprise Cloud Database - Hard-coded Cryptographic Key

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.8.448 × 209.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information and log into the system as any user.

Affected

ProductAffectedFixed inSource
Enterprise Cloud Databaseall versions–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10587-797c6-1.htmlwriteuptwcert.org.tw/en/cp-139-10588-771e5-2.html