Cyber Posture

CVE-2025-2218

Medium

Published: 12 March 2025

Published
12 March 2025
Modified
25 March 2025
KEV Added
Patch
CVSS Score 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0012 30.9th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-2218 is a critical vulnerability in LoveCards LoveCardsV2 versions up to 2.3.2, affecting unknown code in the /api/system/other endpoint of the Setting Handler component. It stems from improper access controls (CWE-266, CWE-284), enabling remote manipulation. The issue was published on 2025-03-12 with a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), indicating medium severity despite the critical classification.

Unauthenticated attackers can exploit this remotely over the network with low complexity and no user interaction required. Successful exploitation results in a low-impact integrity violation, allowing limited modification of data or behavior due to the access control bypass. A public exploit has been disclosed and is available for use.

Advisories from VulDB (ctiid.299290, id.299290) and a detailed write-up on a Notion site document the unauthenticated vulnerability, including a path from initial access to potential RCE. The vendor was notified early but provided no response, and no patches or mitigations are available as of publication. Security practitioners should isolate or decommission affected instances and monitor for exploitation attempts.

Details

CWE(s)
CWE-266CWE-284NVD-CWE-noinfo

Affected Products

lovecards
lovecards
2.1.1 — 2.3.2

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is an unauthenticated access control bypass in a public-facing API endpoint (/api/system/other), directly enabling exploitation of public-facing applications as described in T1190. The remote manipulation and path to potential RCE align with this initial access technique.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References