by Kastro
Paper/Archive/CVE-2025-4558

CVE-2025-4558

WormHole Tech GPM — WormHole Tech GPM - Unverified Password Change

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.9.449 × 209.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the modified password to log into the system.

Affected

ProductAffectedFixed inSource
GPM< 202502202502CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10114-10b4b-1.htmlwriteuptwcert.org.tw/en/cp-139-10115-f5f14-2.html