CVE-2025-4558 WormHole Tech GPM - Unverified Password Change
Unauthenticated attackers can change any user's password to gain unauthorized access to the WormHole Tech GPM system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4558?
CVE-2025-4558 is a critical authentication bypass vulnerability in WormHole Tech GPM, published on 12 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the modified password to log into the system.
Weakness: CWE-620
Which versions are affected by CVE-2025-4558?
How do I fix CVE-2025-4558?
No fix has been published for CVE-2025-4558 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-4558 being exploited?
There is no known exploitation of CVE-2025-4558 in the wild and no public exploit code.
Sources
Also known as AZL-110339, GHSA-6gj4-63c6-7cg5.