Hidden API Endpoint Vulnerability Affecting Web Application Administrators by Vendor

CVE-2025-54765

What is CVE-2025-54765?

A security issue exists in an API endpoint that is supposed to be accessible solely by web application administrators. This endpoint, however, is inadvertently concealed yet accessible to lower-level read-only users. This loophole enables an attacker to import the appliance's configuration, potentially allowing unauthorized control over the appliance's settings, including the granting of administrative-level permissions to themselves. This vulnerability highlights the necessity for stringent access controls and continuous monitoring of API endpoints to prevent exploitation.

References