{"id":"CVE-2025-2311","state":"PUBLISHED","title":"Authentication Bypass in Sechard Information Technologies' SecHard","description":"Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harvesting Information via API Event Monitoring.\n\nThis issue affects SecHard: before 3.3.0.20220411.","publishedAt":"2025-03-20T11:55:51.628Z","updatedAt":"2026-06-06T06:14:52.819Z","severity":{"score":9,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"TR-CERT"},"assigner":"TR-CERT","products":["Sechard Information Technologies SecHard"],"affected":[{"vendor":"Sechard Information Technologies","product":"SecHard","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.3.0.20220411","versionType":"custom"}]}],"references":["https://www.usom.gov.tr/bildirim/tr-25-0074","https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0074"],"weaknesses":["CWE-648","CWE-319","CWE-522"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/2xxx/CVE-2025-2311.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-2311","state":"PUBLISHED","datePublished":"2025-03-20T11:55:51.628Z","dateUpdated":"2026-06-06T06:14:52.819Z","assignerShortName":"TR-CERT","assignerOrgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","dateReserved":"2025-03-14T13:25:01.277Z"},"containers":{"cna":{"title":"Authentication Bypass in Sechard Information Technologies' SecHard","descriptions":[{"lang":"en","value":"Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harvesting Information via API Event Monitoring.\n\nThis issue affects SecHard: before 3.3.0.20220411."}],"affected":[{"vendor":"Sechard Information Technologies","product":"SecHard","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.3.0.20220411","versionType":"custom"}]}],"references":[{"url":"https://www.usom.gov.tr/bildirim/tr-25-0074","tags":["government-resource","broken-link"]},{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0074","tags":["government-resource"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9,"vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-648","lang":"en","description":"CWE-648 Incorrect Use of Privileged APIs","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-319","lang":"en","description":"CWE-319 Cleartext Transmission of Sensitive Information","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-522","lang":"en","description":"CWE-522 Insufficiently Protected Credentials","type":"CWE"}]}],"providerMetadata":{"shortName":"TR-CERT","orgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","dateUpdated":"2026-06-06T06:14:52.819Z"},"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]},{"capecId":"CAPEC-113","descriptions":[{"lang":"en","value":"CAPEC-113 Interface Manipulation"}]},{"capecId":"CAPEC-114","descriptions":[{"lang":"en","value":"CAPEC-114 Authentication Abuse"}]},{"capecId":"CAPEC-383","descriptions":[{"lang":"en","value":"CAPEC-383 Harvesting Information via API Event Monitoring"}]}],"credits":[{"lang":"en","value":"Berat Ugur DEMIRKAN","type":"finder"},{"lang":"en","value":"BG-TEK Cyber Security","type":"sponsor"}],"source":{"defect":["TR-25-0074"],"advisory":"TR-25-0074","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-20T13:01:52.171386Z","id":"CVE-2025-2311","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-20T13:05:28.736Z"}}]}}}