CVE-2025-63958 Missing authorization in n/a
Unauthenticated attackers can access a sensitive configuration endpoint to retrieve plaintext credentials and internal settings, potentially leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-63958?
CVE-2025-63958 is a critical missing authorization vulnerability in n/a, published on 24 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authentication. This page leaks plaintext database credentials, file share paths, internal license server configuration, and software update parameters. An unauthenticated attacker can retrieve this information by accessing the endpoint directly, potentially leading to full system compromise. The vulnerability is due to missing access controls on a privileged administrative function.
Which versions are affected by CVE-2025-63958?
It affects 1 product.
Products include Millensys Vision Tools Workspace.
How do I fix CVE-2025-63958?
No fix has been published for CVE-2025-63958 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-63958 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-63958 exists.
Sources
Also known as GHSA-gcc2-qf7h-c2x4.