CVE-2025-4430 Summary
Overview
CVE-2025-4430 was published on May 14, 2025, involving a critical vulnerability in the EZD RP software developed by NASK – PIB. This issue affects all versions of the product prior to version 20.19. The vulnerability is categorized under the Common Weakness Enumeration (CWE) as a missing authorization flaw (CWE-862).
Provider and Affected Versions
The vulnerable software, EZD RP, is offered by the Scientific and Academic Computer Network – National Research Institute (NASK). The identified security weakness impacts any version released before the launch of version 20.19, which occurred on August 22, 2024.
Nature of the Vulnerability
The vulnerability in question allows unauthorized access to the /api/Token/gettoken endpoint within the EZD RP framework. This endpoint’s exposure leads to potential file manipulation, posing a significant risk to users and systems utilizing the affected software.
Disclosure and Acknowledgments
CERT Polska, the Polish Computer Emergency Response Team, has received reports regarding this vulnerability and has played a key role in its disclosure coordination. The responsible reporting of this vulnerability is credited to Jakub Płatek, a member of NASK-PIB, whose efforts in following responsible disclosure practices were essential in bringing this issue to light.
Mitigation and Recommendations
Users of EZD RP should urgently upgrade to version 20.19 or later to mitigate the risk associated with CVE-2025-4430. For those who may still be using earlier versions, it is advised to review and possibly restrict access to the vulnerable endpoint to limit potential exploitation until an upgrade can be performed.
Additional Resources
For more details about the vulnerability disclosure process and other security vulnerabilities, CERT Polska provides resources on their official site at cert.pl/en/cvd. This site offers guidance on vulnerability reporting and the importance of maintaining secure systems.
Conclusion
CVE-2025-4430 represents a critical security breach affecting the EZD RP software, necessitating immediate action from users to protect their systems from unauthorized access and potential manipulation of files. Regular software updates and vigilant monitoring of software vulnerabilities are essential practices for maintaining cybersecurity.