CVE-2025-29556
Last modified
CVE-2025-29556 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restrictions preventing users with the Admin role from creating or modifying users with the Security Officer role without approval. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restrictions preventing users with the Admin role from creating or modifying users with the Security Officer role without approval. However, a flaw in the account creation process allows an attacker to bypass these restrictions via API request manipulation. An attacker with an Admin access can intercept and modify the API request during user creation, altering the parameters to assign the new account to the ExaGrid Security Officers group without the required approval.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-29556?
How severe is CVE-2025-29556?
How do I fix CVE-2025-29556?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-29529ITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 wa…6.5
- CVE-2025-2953A vulnerability, which was classified as problematic, has be…5.5
- CVE-2025-29534An authenticated remote code execution vulnerability in Powe…8.8
- CVE-2025-2954A vulnerability, which was classified as problematic, was fo…5.5
- CVE-2025-29547In Rollback Rx Professional 12.8.0.0, the driver file shield…7
- CVE-2025-2955A vulnerability has been found in TOTOLINK A3000RU up to 5.9…6.9
- CVE-2025-29557ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Acce…5.4
- CVE-2025-2956A vulnerability was found in TRENDnet TI-G102i 1.0.7.S0_ /1.…7.1
- CVE-2025-29568A vulnerability has been discovered in the code-projects Onl…4.8
- CVE-2025-2957A vulnerability was found in TRENDnet TEW-411BRP+ 2.07. It h…7.1
- CVE-2025-29570An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T4…7.8
- CVE-2025-29572Rejected reason: This CVE ID has been rejected or withdrawn …
Are you affected by CVE-2025-29556?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST