CVE-2025-59101
HighSummary
The vulnerability in Access Manager relies on per-request verification of the originating IP address instead of session tokens or cookies. Once an authentication request from a given IP succeeds, that IP is treated as authenticated with no other session data stored. An attacker can spoof the IP of a logged-in user to gain access to the Access Manager web interface.
Risk Assessment
The risk is unauthorized access to the Access Manager admin panel via IP spoofing, potentially leading to system compromise, data theft, or further network attacks.
Recommendation
Immediately implement session- or token-based authentication instead of IP-based verification. Consider enforcing multi-factor authentication (MFA) and monitoring logs for unusual requests from different IP addresses.
Other vulnerabilities in Access Manager
See all- CVE-2025-59098High
The Access Manager offers a trace functionality for debugging, implemented as a simple TCP socket. Debug data is permanently broadcasted on this socket without any authentication or encryption. The verbosity level can be set via HTTP(S) endpoint with the service interface password or via SOAP interface with a guessable device identifier.
- CVE-2025-59108Critical
By default, the password for the Access Manager's web interface is set to 'admin'. In the tested version, changing the password was not enforced.
- CVE-2025-59103Critical
Access Manager 92xx in hardware revision K7 runs Linux instead of Windows CE. An SSH service on port 22 exposes two users with hardcoded weak passwords that are easy to guess. Passwords are randomized only if the device date is set before 2022, so under certain conditions (e.g., unset clock) they remain unchanged.
- CVE-2026-27768Medium
SQL Injection vulnerability in the Access Manager role. An attacker can inject malicious SQL queries.
Original NVD description (English source)
Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated. No other session information is stored. Therefore, it is possible to spoof the IP address of a logged-in user to gain access to the Access Manager web interface.