CVE-2025-27847
BaseFortify
Publication date: 2025-08-14
Last updated on: 2025-08-15
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| espec | north_america_web_controller | 3.3.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in ESPEC North America Web Controller version 3 before 3.3.8, where user session privileges are not revoked upon logout via the /api/v4/auth/ endpoint. This means that after a user logs out, their session privileges may still remain active, potentially allowing unauthorized access.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access because user session privileges are not properly revoked on logout. This could allow attackers or unauthorized users to continue accessing the system with the privileges of a logged-out user, potentially leading to data exposure or unauthorized actions.