Vulnerability details
CVE-2025-4687
Teltonika Networks RMS
Account pre-hijacking through invite misuse
CVSS 4.0
7.2High
Official description
In Teltonika Networks Remote Management System (RMS), it is possible to perform account pre-hijacking by misusing the invite functionality. If a victim has a pending invite and registers to the platform directly, they are added to the attackers company without their knowledge. The victims account and their company can then be managed by the attacker.This issue affects RMS: before 5.7.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.2High | 4.0 | CVEProject cvelistV5 (CNA) (tlt_net) | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:H/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Teltonika Networks | RMS | v < 5.7 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-05-29
- Last updated
- 2025-05-29
- State
- Published
- Assigner (CNA)
- tlt_net
Exploit prediction (EPSS)
0.47%
Probability of exploitation in 30 days
41.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-288Authentication Bypass Using an Alternate Path or Channel