CVE-2025-62004 BullWall Server Intrusion Protection (SIP) initialization race condition
A local authenticated attacker can bypass Multi-Factor Authentication by logging in during a startup race condition before security services initialize.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-62004?
CVE-2025-62004 is a high-severity vulnerability in BullWall Server Intrusion Protection, published on 18 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
BullWall Server Intrusion Protection (SIP) services are initialized after login services during system startup. A local, authenticated attacker can log in after boot and before SIP MFA is running. The SIP services do not retroactively enforce MFA or disconnect sessions that were not subject to SIP MFA. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions mayy also be affected. BullWall plans to improve detection method documentation.
Weakness: CWE-367
Which versions are affected by CVE-2025-62004?
It affects 1 product.
Products include Bullwall Server Intrusion Protection.
How do I fix CVE-2025-62004?
No fix has been published for CVE-2025-62004 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-62004 being exploited?
There is no known exploitation of CVE-2025-62004 in the wild and no public exploit code.
Other vulnerabilities in BullWall Server Intrusion Protection
Sources
Also known as GHSA-chcm-jqp3-j5w3.