CVE-2025-54943

CRITICAL

SUNNET Corporate Training Management System < 10.11 - Missing Authorization for Application Deployment

Title source: llm

Description

A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deployment due to the absence of proper access control checks.

References (1)

Core 1

Core References

Vendor Advisory third-party-advisory

https://zuso.ai/advisory/za-2025-11

Scores

CVSS v3 9.8

EPSS 0.0047

EPSS Percentile 37.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-862

Status published

Products (1)

sun.net/ehrd_ctms < 10.11

Published Aug 30, 2025

Tracked Since Feb 18, 2026