Cyber Posture

CVE-2025-11023

Critical

Published: 23 October 2025

Published
23 October 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0015 34.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-11023 is an Inclusion of Functionality from Untrusted Control Sphere vulnerability, manifesting as Improper Control of Filename for Include/Require Statement in PHP Program, commonly known as PHP Remote File Inclusion, within ArkSigner Software and Hardware Inc.'s AcBakImzala product. This flaw enables PHP Local File Inclusion and affects all versions of AcBakImzala prior to v5.1.4. It is associated with CWE-98 and CWE-829.

The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely over the network by an unauthenticated attacker with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or file access on the affected system.

Mitigation requires upgrading to AcBakImzala v5.1.4 or later. Further details are provided in the advisory at https://www.usom.gov.tr/bildirim/tr-25-0356.

Details

CWE(s)
CWE-98CWE-829

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

CVE-2025-11023 is a remote file inclusion vulnerability in a public-facing PHP application, directly enabling exploitation of public-facing applications for arbitrary code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References