by Kastro
Paper/Archive/CVE-2025-54336

CVE-2025-54336

mitre — In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison.

EPSS 0.5%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.0.460 × 209.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 (such as the 0e0 string). This occurs in admin/plib/LoginManager.php.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refplesk.com/blog/plesk-news-announcements/introducing-plesk-obsidian-18-0-70-anniversary-editionrefsupport.plesk.com/hc/en-us/articles/33785727869847-Vulnerability-CVE-2025-54336refblog.aziz.tn/2025/08/cve-2025-54336.html