CVE-2025-8855

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8855", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2025-08-11T07:47:10.546Z", "datePublished": "2025-11-14T12:39:46.458Z", "dateUpdated": "2026-06-05T11:23:01.452Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-06-05T11:23:01.452Z"}, "title": "2FA Expiry Bypass in Optimus Software's Brokerage Automation", "datePublic": "2025-11-14T12:31:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-640", "description": "CWE-640 Weak Password Recovery Mechanism for Forgotten Password", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-302", "description": "CWE-302 Authentication Bypass by Assumed-Immutable Data", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-22", "descriptions": [{"lang": "en", "value": "CAPEC-22 Exploiting Trust in Client"}]}, {"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}, {"capecId": "CAPEC-203", "descriptions": [{"lang": "en", "value": "CAPEC-203 Manipulate Registry Information"}]}], "affected": [{"vendor": "Optimus Software", "product": "Brokerage Automation", "versions": [{"status": "affected", "version": "0", "lessThan": "1.1.71", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information.\n\nThis issue affects Brokerage Automation: before 1.1.71.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information.<p>This issue affects Brokerage Automation: before 1.1.71.</p>"}]}], "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0396", "tags": ["government-resource", "broken-link"]}, {"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0396", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}}], "credits": [{"lang": "en", "value": "Can Nesimi ARI", "type": "finder"}], "source": {"defect": ["TR-25-0396"], "advisory": "TR-25-0396", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-14T13:20:09.506876Z", "id": "CVE-2025-8855", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T13:20:17.282Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8855", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-14T13:20:09.506876Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T13:20:13.522Z"}}], "cna": {"title": "2FA Expiry Bypass in Optimus Software's Brokerage Automation", "source": {"defect": ["TR-25-0396"], "advisory": "TR-25-0396", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Can Nesimi ARI"}], "impacts": [{"capecId": "CAPEC-22", "descriptions": [{"lang": "en", "value": "CAPEC-22 Exploiting Trust in Client"}]}, {"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}, {"capecId": "CAPEC-203", "descriptions": [{"lang": "en", "value": "CAPEC-203 Manipulate Registry Information"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Optimus Software", "product": "Brokerage Automation", "versions": [{"status": "affected", "version": "0", "lessThan": "1.1.71", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2025-11-14T12:31:00.000Z", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0396", "tags": ["government-resource", "broken-link"]}, {"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0396", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information.\n\nThis issue affects Brokerage Automation: before 1.1.71.", "supportingMedia": [{"type": "text/html", "value": "Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information.<p>This issue affects Brokerage Automation: before 1.1.71.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-640", "description": "CWE-640 Weak Password Recovery Mechanism for Forgotten Password"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-302", "description": "CWE-302 Authentication Bypass by Assumed-Immutable Data"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-06-05T11:23:01.452Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8855", "state": "PUBLISHED", "dateUpdated": "2026-06-05T11:23:01.452Z", "dateReserved": "2025-08-11T07:47:10.546Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2025-11-14T12:39:46.458Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Brokerage Automation", "vendor": "Optimus Software", "versions": [{"lessThan": "1.1.71", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "iletisim@usom.gov.tr"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information.\n\nThis issue affects Brokerage Automation: before 1.1.71."}, {"lang": "es", "value": "Omisi\u00f3n de autorizaci\u00f3n mediante clave controlada por el usuario, mecanismo d\u00e9bil de recuperaci\u00f3n de contrase\u00f1a para contrase\u00f1a olvidada, vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n mediante datos asumidos como inmutables en Optimus Software Brokerage Automation permite explotar la confianza en el cliente, omisi\u00f3n de autenticaci\u00f3n y manipular informaci\u00f3n del registro. Este problema afecta a Brokerage Automation: versiones anteriores a la 1.1.71."}], "id": "CVE-2025-8855", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "iletisim@usom.gov.tr", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8855", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-14T13:20:09.506876Z", "version": "2.0.3"}}]}, "published": "2025-11-14T13:15:45.337", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0396"}, {"source": "iletisim@usom.gov.tr", "url": "https://www.usom.gov.tr/bildirim/tr-25-0396"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-302"}, {"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-640"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{}

{"created": "2025-11-15T22:07:45.877345+00:00", "updated": "2025-11-15T22:07:45.877397+00:00", "vendors": ["optimus_software", "optimus_software$PRODUCT$brokerage_automation"]}