CVE-2025-53118

published 2025-08-25

CVE-2025-53118: An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of…

Priority P1 90 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
securden	unified_pam	9.0.* – 11.3.1	—

Detection & IOCs extracted from sources · hover to see the quote

url /thirdparty-access

url /get_csrf_token

url /get_date_picker_format

other icon_hash=1798893256

other icon_hash=-766529773

• → Probe for unauthenticated access to /thirdparty-access; a 302 redirect (rather than an auth challenge) indicates the endpoint is reachable without credentials and the vulnerability may be present.
• → An unauthenticated HTTP 200 response from /get_csrf_token containing a JSON body with 'token' and Content-Type application/json confirms the authentication bypass on the CSRF token endpoint.
• → An unauthenticated HTTP 200 response from /get_date_picker_format containing 'current_date' in a JSON body confirms the authentication bypass on the date-picker endpoint, completing the three-step exploit chain.
• → Use FOFA icon-hash fingerprints to identify Securden Unified PAM instances exposed on the internet before probing for the vulnerability.
• → The full exploit requires three sequential unauthenticated requests (flow: http(1) & http(2) & http(3)); all three steps succeeding together is a high-confidence indicator of exploitation.

• · The Nuclei template is verified (verified: true) and requires exactly 3 HTTP requests (max-request: 3); detection logic depends on all three matchers passing in sequence.
• · The vulnerability allows an unauthenticated attacker to control administrator backup functions, meaning exploitation can lead to full compromise of stored passwords, secrets, and session tokens without any prior authentication. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306