CVE-2025-67418

{
  "id": "CVE-2025-67418",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-22T20:15:45.303",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the administrative panel using these default credentials, resulting in full administrative control of the application."
    },
    {
      "lang": "es",
      "value": "ClipBucket 5.5.2 se ve afectado por un problema de control de acceso inadecuado donde el producto se envía o se implementa con credenciales administrativas predeterminadas codificadas de forma rígida. Un atacante remoto no autenticado puede iniciar sesión en el panel administrativo utilizando estas credenciales predeterminadas, lo que resulta en un control administrativo total de la aplicación."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-22T19:51:43.326409Z",
          "id": "CVE-2025-67418",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.3",
              "versionEndIncluding": "5.5.2",
              "matchCriteriaId": "15859994-9C26-499F-9707-66E2040BBC82"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://medium.com/@arpit03sharma2003/cve-2025-67418-when-default-credentials-become-a-remote-root-button-03be5ee4b927",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ]
    }
  ]
}