CVE-2025-0586
Published: 20 January 2025
Description
The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privileges and regular system privileges to perform arbitrary code execution.
Security Summary
CVE-2025-0586 is an insecure deserialization vulnerability (CWE-502) affecting the a+HRD software from aEnrich Technology. Published on January 20, 2025, it has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
Remote attackers who possess database modification privileges alongside regular system privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables arbitrary code execution on the affected system.
Mitigation details and advisories are available from TWCERT/CC at https://www.twcert.org.tw/en/cp-139-8375-59abd-2.html and https://www.twcert.org.tw/tw/cp-132-8374-7085a-1.html.
Details
- CWE(s)