CVE-2025-34140
HIGHETQ Reliance CG < SE.2025.1/2025.1.2 & NXG < SE.2025.1/2025.1.2 - Unauthenticated Authorization Bypass
Title source: llmDescription
An authorization bypass vulnerability exists in ETQ Reliance (legacy CG and NXG SaaS platforms). By appending a specific URI suffix to certain API endpoints, an unauthenticated attacker can bypass access control checks and retrieve limited sensitive resources. The root cause was a misconfiguration in API authorization logic, which has since been corrected in SE.2025.1 and 2025.1.2.
References (3)
Core 3
Core References
Various Sources product
https://www.etq.com/product-overview/
Various Sources vendor-advisory
patch
https://www.etq.com/blog/etq-reliance-security-update/
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/etq-reliance-cg-nxg-api-authorization-bypass-via-localized-text-uri-suffix
Scores
CVSS v4
8.7
EPSS
0.0060
EPSS Percentile
44.0%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-639
Status
published
Products (6)
ETQ/Reliance CG (legacy)
< 2025.1.2
ETQ/Reliance CG (legacy)
< SE.2025.1
ETQ/Reliance CG (legacy)
SE.2025.1
ETQ/Reliance NXG (SaaS)
< 2025.1.2
ETQ/Reliance NXG (SaaS)
< SE.2025.1
ETQ/Reliance NXG (SaaS)
2025.1.2
Published
Jul 22, 2025
Tracked Since
Feb 18, 2026