CVE-2025-65239

MediumCVSS 4.3

Published: 26/11/2025(UTC)Updated: 04/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

24th percentile - higher than 24% of all known CVEs

Summary

Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers with low-level privileges to read server logs.

Risk Assessment

An attacker with low-level privileges can access server logs, potentially exposing sensitive information such as session data, configuration, or other system details.

Recommendation

Implement proper access control mechanisms for the /aux1/ocussd/trace endpoint, restricting it to authorized users only, and consider updating to a newer version if available.

Other vulnerabilities in OpenCode Systems USSD Gateway OC

CVE-2025-65237Medium
A reflected cross-site scripting (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload.

Original NVD description (English source)

Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers with low-level privileges to read server logs.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS