by Kastro
Paper/Archive/CVE-2025-3709

CVE-2025-3709

Flowring Technology Agentflow — Flowring Technology Agentflow - Account Lockout Bypass

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.8.468 × 209.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perform password brute force attack.

Affected

ProductAffectedFixed inSource
Agentflow4.0–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10091-12462-1.htmlwriteuptwcert.org.tw/en/cp-139-10090-112f7-2.html