Vulnerability details
CVE-2025-8853
2100 Technology Official Document Management System
2100 Technology｜Official Document Management System - Authentication Bypass
CVSS 4.0
9.3Critical
Official description
Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtain any user's connection token and use it to log into the system as that user.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (twcert) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (twcert) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| 2100 Technology | Official Document Management System | 5.0.89.0 | CVEProject cvelistV5 (CNA) |
| 2100 Technology | Official Document Management System | 5.0.89.1 | CVEProject cvelistV5 (CNA) |
| 2100 Technology | Official Document Management System | 5.0.89.2 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://www.twcert.org.tw/tw/cp-132-10319-adc18-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-10320-ad540-2.html third-party-advisory
- https://www.chtsecurity.com/news/8618a2f0-390a-4506-9ff8-a9e74030d19e third-party-advisory
- https://www.chtsecurity.com/news/a9a90f0b-c2cb-4c66-b3d1-bc7f252fd108 third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-08-11
- Last updated
- 2025-08-11
- State
- Published
- Assigner (CNA)
- twcert
Exploit prediction (EPSS)
0.75%
Probability of exploitation in 30 days
55.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-290Authentication Bypass by Spoofing