CVE-2025-12266

MEDIUM

Zytec Dalian Zhuoyun Technology Central Authentication Service <202...

Title source: llm
STIX 2.1

Description

A vulnerability was detected in Zytec Dalian Zhuoyun Technology Central Authentication Service up to 20251009. This vulnerability affects the function _empty of the file /index.php/auth/widget. Performing manipulation of the argument get.layer/get.widget/get.action results in code injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.329938
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.329938
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.671721

Scores

CVSS v3 6.3
EPSS 0.0031
EPSS Percentile 22.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-94
Status published
Products (1)
Zytec Dalian Zhuoyun Technology/Central Authentication Service 20251009
Published Oct 27, 2025
Tracked Since Feb 18, 2026