CVE-2025-54561

{
  "id": "CVE-2025-54561",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-14T18:15:49.527",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote access to content despite lack of the correct permission through a Broken Authorization Schema."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de control de acceso incorrecto se encontró en el servidor de aplicaciones de Desktop Alert PingAlert versiones 6.1.0.11 a 6.1.1.2 que permite acceso remoto a contenido a pesar de la falta del permiso correcto a través de un Esquema de Autorización Roto."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-14T18:35:50.386830Z",
          "id": "CVE-2025-54561",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:desktopalert:pingalert_application_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.1.0.11",
              "versionEndExcluding": "6.1.1.5",
              "matchCriteriaId": "35DFA98A-F509-4F93-99A3-807C4B6548A2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://desktopalert.net",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://desktopalert.net/cve-2025-54561/",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}