CVE-2025-30236

HIGH

Shearwater SecurEnvoy SecurAccess <9.4.515 - Auth Bypass

Title source: llm
STIX 2.1

Description

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) if an HTTP POST request contains a SESSION parameter.

References (2)

Scores

CVSS v3 8.6
EPSS 0.0026
EPSS Percentile 49.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-472
Status published
Products (1)
SecurEnvoy/SecurAccess < 9.4.515
Published Mar 19, 2025
Tracked Since Feb 18, 2026