← back
CVE-2025-4558

WormHole Tech GPM - Unverified Password Change

CVSS 9.3 CRITICALEPSS 0.4%CWE-620
The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the modified password to log into the system.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
WormHole Tech · GPM

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://www.twcert.org.tw/en/cp-139-10115-f5f14-2.htmlhttps://www.twcert.org.tw/tw/cp-132-10114-10b4b-1.html