CVE-2025-1226 ywoa setup.jsp improper authorization
Remote attackers can bypass authorization in the setup interface to perform unauthorized actions, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-1226?
CVE-2025-1226 is a medium-severity missing authorization vulnerability in ywoa, published on 12 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in ywoa up to 2024.07.03. It has been declared as critical. This vulnerability affects unknown code of the file /oa/setup/setup.jsp. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
Which versions are affected by CVE-2025-1226?
It affects 1 product.
Products include R1bbit Yimioa.
How do I fix CVE-2025-1226?
No fix has been published for CVE-2025-1226 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-1226 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-1226 exists.
Other vulnerabilities in ywoa
Sources
Also known as GHSA-9vcr-v878-4x73.