5.1
MediumCVSS 4.0 · from CERT-PL
CVE-2025-68392
Incorrect authorization in Protectel
PROTECTELMAJ · Incorrect authorization · CWE-863AffectedPROTECTELMAJ, BDF
FixUpdate to 6.5.19, 6.4.67 or newer
PublishedOct 30, 11:37 · CERT-PL
ScoredOct 30 · 5.1 · CERT-PL
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker has to be on the same network. CVSS: adjacent network.
Description
ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
From CERT-PL
Affected and fixed versions
ProductAffectedFixed inPROTECTELMAJbefore 6.5.196.5.19BDFbefore 6.4.676.4.67
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known