CVE-2025-1723

CVE-2025-1723 is a vulnerability in Zohocorp ManageEngine ADSelfService Plus versions 6510 and below that enables account takeover due to improper session mishandling. Assigned CWE-287 (Improper Authentication), it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high severity with network accessibility, low attack complexity, and requirements for low privileges but no user interaction.

The vulnerability can only be exploited by valid account holders already present in the setup, who require low-level privileges (PR:L). Attackers with such access can leverage session mishandling over the network to achieve account takeover, resulting in high impacts to confidentiality and integrity, such as unauthorized access to other accounts, data exfiltration, or privilege escalation within the affected instance.

The vendor has issued an advisory with mitigation guidance at https://www.manageengine.com/products/self-service-password/advisory/CVE-2025-1723.html, which security practitioners should consult for patch availability and recommended remediation steps.