CVE-2025-40653 User enumeration in M3M Printer Server Web
Attackers can enumerate valid usernames via distinct authentication error messages, facilitating targeted brute-force attacks against M3M Printer Server Web.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-40653?
CVE-2025-40653 is a medium-severity vulnerability in M3M Printer Server Web, published on 26 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine whether a username is valid or not, allowing a brute force attack on valid usernames.
Weakness: CWE-209
Which versions are affected by CVE-2025-40653?
How do I fix CVE-2025-40653?
No fix has been published for CVE-2025-40653 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-40653 being exploited?
There is no known exploitation of CVE-2025-40653 in the wild and no public exploit code.
Sources
Also known as GHSA-9768-6c87-3573.