Detections
Analytics

CVE-2025-4558

critical

Description

The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the modified password to log into the system.

References

https://www.twcert.org.tw/tw/cp-132-10114-10b4b-1.html

https://www.twcert.org.tw/en/cp-139-10115-f5f14-2.html

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-14320

Details

Source: Mitre, NVD

Published: 2025-05-12

Updated: 2026-04-15

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: Critical

EPSS

EPSS: 0.00531