Cyber Posture

CVE-2025-26853

Critical

Published: 20 March 2025

Published
20 March 2025
Modified
23 April 2025
KEV Added
Patch
CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0040 60.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-26853 is a critical vulnerability in DESCOR INFOCAD versions 3.5.1 and prior, stemming from a broken authorization schema as indicated by associated CWEs-863 (Incorrect Authorization) and CWE-862 (Missing Authorization). The issue received a perfect CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), highlighting its severity due to network accessibility, low attack complexity, no required privileges or user interaction, and broad impacts across confidentiality, integrity, and availability with a changed scope. It was published on 2025-03-20.

Unauthenticated attackers can exploit this vulnerability remotely over the network with minimal effort, bypassing authorization controls to gain unauthorized access to the affected INFOCAD software. Successful exploitation enables high-impact outcomes, including complete compromise of confidentiality (e.g., data exposure), integrity (e.g., data manipulation), and availability (e.g., denial of service), potentially leading to full system control given the scope change.

Advisories point to mitigation via patching, with the vulnerability fixed in INFOCAD version 3.5.2.0 as detailed in the official changelog. Security practitioners should reference the DESCOR INFOCAD product page and the specific changelog entry on broken authorization schema for deployment guidance and verification.

Details

CWE(s)
CWE-863CWE-862

Affected Products

descor
infocad
≤ 3.5.2.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Broken authorization (CWE-862/863) in a network-accessible application (AV:N) directly enables remote unauthenticated exploitation for initial access and full system compromise, mapping to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References