CVE-2025-4558

9.3 criticalEPSS 0.5%

Critical (9.3). EPSS 0.5% chance of exploitation in the next 30 days.

The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the modified password to log into the system.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
CWE: CWE-620
Published: 2025-05-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://www.twcert.org.tw/en/cp-139-10115-f5f14-2.html
https://www.twcert.org.tw/tw/cp-132-10114-10b4b-1.html

Check your stack JSON