CVE-2025-10643

CriticalCVSS 9.1

Published: 17/09/2025(UTC)Updated: 26/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.84%

86th percentile - higher than 86% of all known CVEs

Summary

A vulnerability in Wondershare Repairit allows remote attackers to bypass authentication due to incorrect permission assignment on a storage account token. Exploitation does not require authentication.

Risk Assessment

An attacker can bypass authentication in Wondershare Repairit, gaining unauthorized access to the system, potentially leading to data confidentiality and integrity breaches.

Recommendation

Urgently update Wondershare Repairit to a patched version and audit permissions assigned to storage account tokens.

Other vulnerabilities in Wondershare Repairit

CVE-2025-10644Critical
A vulnerability in Wondershare Repairit allows remote attackers to bypass authentication due to incorrect permission assignment on an SAS token. Authentication is not required, and an attacker can launch a supply-chain attack and execute arbitrary code on customers' endpoints.

Original NVD description (English source)

Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Wondershare Repairit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the permissions granted to a storage account token. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26902.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS