CVE-2025-59816

Full vulnerability record from the local CVENow database.

Description

This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including user credentials. User passwords are stored in plaintext, significantly increasing the severity of this issue.

Severity

HIGH

CVSS score

7.3 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2025-09-25 20:15:35.647000

Last modified

2026-10-18 21:10:00.120000

View original CVE JSON

{
  "id": "CVE-2025-59816",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-25T20:15:35.647",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including user credentials. User passwords are stored in plaintext, significantly increasing the severity of this issue."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad permite a los atacantes consultar directamente la base de datos subyacente, recuperando potencialmente todos los datos almacenados en la base de datos de Administración de Facturación, incluyendo las credenciales de usuario. Las contraseñas de usuario se almacenan en texto plano, aumentando significativamente la gravedad de este problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Zenitel",
          "product": "ICX500",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "<1.4.3.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Zenitel",
          "product": "ICX510",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "<1.4.3.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-26T15:42:26.536306Z",
          "id": "CVE-2025-59816",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System",
      "source": "[email protected]"
    },
    {
      "url": "https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes",
      "source": "[email protected]"
    }
  ]
}