CVE-2025-10223 Improper Session Cleanup on Role Removal in Web Admin Panel in AxxonSoft Axxon One (C-Werk)
Authenticated attackers retain access with removed privileges by using unexpired session tokens in the Axxon One Web Admin Panel.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-10223?
CVE-2025-10223 is a medium-severity authentication bypass vulnerability in AxxonSoft AxxonOne C-Werk, published on 10 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticated attacker to retain access with removed privileges via continued use of an unexpired session token until natural expiration.
Weakness: CWE-613
Which versions are affected by CVE-2025-10223?
It affects 1 product.
Products include Axxonsoft Axxon One.
How do I fix CVE-2025-10223?
No fix has been published for CVE-2025-10223 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-10223 being exploited?
There is no known exploitation of CVE-2025-10223 in the wild and no public exploit code.
Other vulnerabilities in AxxonSoft AxxonOne C-Werk
- CVE-2025-10220 Outdated Third-Party NuGet Packages in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4
- CVE-2025-10226 Supply chain in AxxonOne C-Werk
- CVE-2025-10225 Incorrect Memory Allocation in OpenSSL-Based Session Module in AxxonSoft Axxon One (C-Werk)
- CVE-2025-10221 Hardcoded Password Exposure in AxxonNet (C-WerkNet) ARP Agent Logs
- CVE-2025-10224 Incorrect Evaluation of LDAP Nested Groups during Login in AxxonSoft Axxon One (C-Werk)
Sources
Also known as GHSA-93mj-r99m-6gfm.