Paper/Archive/CVE-2025-3895

CVE-2025-3895

Jan Syski MegaBIP — Low token entropy in MegaBIP

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 43.5.435 × 208.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. It allows an unauthenticated attacker who know user login names to brute force these tokens and change account passwords (including these belonging to administrators). Version 5.20 of MegaBIP fixes this issue.

Affected

ProductAffectedFixed inSource

MegaBIP≤ 5.19–CNA

Scores by source

CERT-PL (CNA)9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupcert.pl/en/posts/2025/05/CVE-2025-3893 advisorymegabip.pl/index.php?id=24,145 refgov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej