CVE-2025-13480

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13480", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2025-11-20T14:44:26.478Z", "datePublished": "2026-04-20T09:00:16.259Z", "dateUpdated": "2026-04-20T13:28:18.280Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Fudo Enterprise", "vendor": "Fudo Security", "versions": [{"lessThanOrEqual": "5.6.2", "status": "affected", "version": "5.5.0", "versionType": "semver"}]}], "datePublic": "2026-04-20T15:11:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings.<br>This vulnerability has been fixed in version 5.6.3"}], "value": "Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings.\nThis vulnerability has been fixed in version 5.6.3"}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-04-20T09:00:16.259Z"}, "references": [{"tags": ["product"], "url": "https://www.fudosecurity.com/product/enterprise"}, {"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2026/04/CVE-2025-13480"}, {"tags": ["release-notes"], "url": "https://download.fudosecurity.com/documentation/fudo/5_6/rn/RN_5.6.3.pdf"}], "source": {"discovery": "INTERNAL"}, "title": "Incorrect authorization in Fudo Enterprise", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T13:28:12.201027Z", "id": "CVE-2025-13480", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:28:18.280Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13480", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T13:28:12.201027Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:28:15.072Z"}}], "cna": {"title": "Incorrect authorization in Fudo Enterprise", "source": {"discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Fudo Security", "product": "Fudo Enterprise", "versions": [{"status": "affected", "version": "5.5.0", "versionType": "semver", "lessThanOrEqual": "5.6.2"}], "defaultStatus": "unaffected"}], "datePublic": "2026-04-20T15:11:00.000Z", "references": [{"url": "https://www.fudosecurity.com/product/enterprise", "tags": ["product"]}, {"url": "https://cert.pl/en/posts/2026/04/CVE-2025-13480", "tags": ["third-party-advisory"]}, {"url": "https://download.fudosecurity.com/documentation/fudo/5_6/rn/RN_5.6.3.pdf", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings.\nThis vulnerability has been fixed in version 5.6.3", "supportingMedia": [{"type": "text/html", "value": "Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings.<br>This vulnerability has been fixed in version 5.6.3", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-04-20T09:00:16.259Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13480", "state": "PUBLISHED", "dateUpdated": "2026-04-20T13:28:18.280Z", "dateReserved": "2025-11-20T14:44:26.478Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-04-20T09:00:16.259Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Fudo Enterprise", "vendor": "Fudo Security", "versions": [{"lessThanOrEqual": "5.6.2", "status": "affected", "version": "5.5.0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fudosecurity:fudo_enterprise:*:*:*:*:*:*:*:*", "matchCriteriaId": "C973DECA-7589-4C6C-BE49-24BB0D4BA09C", "versionEndExcluding": "5.6.3", "versionStartIncluding": "5.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings.\nThis vulnerability has been fixed in version 5.6.3"}, {"lang": "es", "value": "Fudo Enterprise en versiones desde la 5.5.0 hasta la 5.6.2 permite a usuarios con bajos privilegios acceder a ciertos recursos exclusivos de administrador a trav\u00e9s de puntos finales de API indebidamente protegidos. Esto incluye informaci\u00f3n sensible como registros del sistema y partes de la configuraci\u00f3n del sistema. Esta vulnerabilidad ha sido corregida en la versi\u00f3n 5.6.3."}], "id": "CVE-2025-13480", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13480", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T13:28:12.201027Z", "version": "2.0.3"}}]}, "published": "2026-04-20T10:16:16.060", "references": [{"source": "cvd@cert.pl", "tags": ["Third Party Advisory"], "url": "https://cert.pl/en/posts/2026/04/CVE-2025-13480"}, {"source": "cvd@cert.pl", "tags": ["Release Notes"], "url": "https://download.fudosecurity.com/documentation/fudo/5_6/rn/RN_5.6.3.pdf"}, {"source": "cvd@cert.pl", "tags": ["Product"], "url": "https://www.fudosecurity.com/product/enterprise"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.5.0,5.6.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Fudo Enterprise", "source": "cna", "vendor": "Fudo Security"}, "product": "fudo_enterprise", "vendor": "fudo_security"}], "analysis": {"en": {"generated_at": "2026-04-20T10:20:45.608054+00:00", "value": {"mitigation_remediation": ["Upgrade to Fudo Enterprise version 5.6.3 or later to receive the official fix.", "Enforce strict role\u2011based access controls on API endpoints so only administrators can access logs and configuration data.", "Monitor API usage for abnormal access patterns to detect and respond to potential misuse of privileges."], "summary": {"action": "Upgrade", "impact": "Unauthorized access to sensitive data"}, "threat_synthesis": {"affected_systems": "All installations of Fudo Security Fudo Enterprise running versions 5.5.0 through 5.6.2 are affected. The issue has been fixed in version 5.6.3 and later.", "description_and_impact": "Fudo Enterprise API endpoints fail to enforce proper authorization, allowing users with limited privileges to retrieve administrative data such as system logs and configuration settings. This flaw provides direct access to sensitive information, compromising confidentiality and potentially exposing operational secrets.", "risk_and_exploitability": "The vulnerability has a CVSS score of 5.1, indicating moderate severity. It is not listed in the CISA KEV catalog and no EPSS score is available. Exploitation requires an existing user account with non-administrative privileges, so attacks are typically internal or on trusted networks where such accounts exist. The attacker can read logs and configuration settings, but the impact is limited to data disclosure rather than system compromise."}}}}, "created": "2026-04-20T10:30:04.395719+00:00", "updated": "2026-04-20T14:57:57.250116+00:00", "vendors": ["fudo_security", "fudo_security$PRODUCT$fudo_enterprise"]}