CVE-2025-34143

An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login page to obtain elevated access. Once authenticated, an attacker could achieve remote code execution by modifying Jython scripts within the application. This issue was resolved by introducing stricter validation logic to exclude internal accounts from public authentication workflows in version MP-4583.

• CWE-78
• CWE-269
• CWE-288

• https://slcyber.io/assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-etq-reliance/
• https://www.etq.com/blog/etq-reliance-security-update/
• https://www.etq.com/product-overview/
• https://www.vulncheck.com/advisories/etq-reliance-cg-authentication-bypass-via-trailing-space-rce

Published

Jul 22, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-34138Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-34139A vulnerability exists in Sitecore Experience Manager (XM), …8.7
• CVE-2025-3414The Structured Content (JSON-LD) #wpsc WordPress plugin befo…5.4
• CVE-2025-34140An authorization bypass vulnerability exists in ETQ Reliance…8.7
• CVE-2025-34141A reflected cross-site scripting (XSS) vulnerability exists …5.1
• CVE-2025-34142An XML External Entity (XXE) injection vulnerability exists …6.9
• CVE-2025-34144Rejected reason: This CVE ID was rejected because it was res…
• CVE-2025-34145Rejected reason: This CVE ID was rejected because it was res…
• CVE-2025-34146A prototype pollution vulnerability exists in @nyariv/sandbo…7
• CVE-2025-34147An unauthenticated OS command injection vulnerability exists…9.4
• CVE-2025-34148An unauthenticated OS command injection vulnerability exists…9.4
• CVE-2025-34149A command injection vulnerability affects the Shenzhen Aitem…9.4