CVE-2025-30235

3.5 lowEPSS 0.2%

Low (3.5). EPSS 0.2% chance of exploitation in the next 30 days.

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have had more than 10 failed authentication attempts, but instead allows hundreds of failed authentication attempts, because concurrent attempts are mishandled.

Severity

CVSS 3.1

3.5 low

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-362
Published: 2025-03-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://reserge.org/probabilistically-breaking-securenvoy-totp/
https://securenvoy.com/wp-content/uploads/2025/03/Release-Notes-9.4.515.pdf

Check your stack JSON