CVE-2025-11284
BaseFortify
Publication date: 2025-10-05
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zytec | dalian_zhuyun_technology_central_authentication_service | 3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-255 | |
| CWE-259 | The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11284 is a remote code execution vulnerability in Zytec Dalian Zhuoyun Technology Central Authentication Service 3. It occurs due to the use of a hard-coded password in the Authorization HTTP header within the /index.php/auth/Ops/git component. Attackers can manipulate this Authorization argument to bypass authentication and remotely execute arbitrary commands on the affected system without any prior authentication. [1, 3]
How can this vulnerability impact me? :
This vulnerability allows attackers to remotely execute arbitrary commands on the affected system, potentially leading to unauthorized access, data compromise, and disruption of services. Since the affected component is a central authentication service, exploitation could compromise the entire authentication mechanism of an organization, affecting multiple systems and users. The vulnerability is easy to exploit and publicly disclosed, increasing the risk of attacks. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to the path /index.php/auth/Ops/git for suspicious Authorization headers using the hard-coded password. You can look for HTTP requests containing the header Authorization: Basic enl0ZWM6WUdEMHc3bW9FSw==. Additionally, you can attempt to test the vulnerability by sending a crafted POST request similar to the example exploit, for instance using curl: curl -X POST "http://<target>/index.php/auth/Ops/git" \ -H "Authorization: Basic enl0ZWM6WUdEMHc3bW9FSw==" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "cmd=142&cwd=¶ms[append]=||whoami" If the server executes the command and returns the output, it is vulnerable. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying restrictive firewall rules to limit access to the vulnerable endpoint /index.php/auth/Ops/git, especially blocking unauthorized external access. Since the vendor has not provided a patch, restricting network access to trusted IPs or internal networks is critical. Monitoring and blocking HTTP requests containing the hard-coded Authorization header can also help reduce exploitation risk. [3]