CVE-2025-40806

MediumCVSS 5.3

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

38th percentile - higher than 38% of all known CVEs

Summary

A vulnerability in Gridscale X Prepay (versions before 4.2.1) allows user enumeration through distinguishable responses. A remote unauthenticated attacker can determine if a user is valid, enabling brute force attacks.

Risk Assessment

The risk is the possibility of targeted brute force attacks on valid accounts, potentially leading to unauthorized access.

Recommendation

Immediately upgrade Gridscale X Prepay to version 4.2.1 or later, which fixes this vulnerability.

Other vulnerabilities in Gridscale X Prepay

CVE-2025-40807Medium
Gridscale X Prepay (all versions < V4.2.1) is vulnerable to capture-replay of authentication tokens. This could allow an authenticated but already locked-out user to establish still valid user sessions.

Original NVD description (English source)

A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack with valid users.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS