CVE-2025-64386 HIJACKING OF THE TOKEN AND GAINING ACCESS
Attackers can hijack active JWT tokens to steal sessions and modify security parameters without detection on Circutor TCPRS1plus devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-64386?
CVE-2025-64386 is a high-severity authentication bypass vulnerability in Circutor TCPRS1plus, published on 31 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session without the legitimate and active session detecting it. The web server allows the attacker to reuse an old session JWT token while the legitimate session is active.
Weakness: CWE-613
Which versions are affected by CVE-2025-64386?
How do I fix CVE-2025-64386?
No fix has been published for CVE-2025-64386 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-64386 being exploited?
There is no known exploitation of CVE-2025-64386 in the wild and no public exploit code.
Sources
Also known as GHSA-4m38-cfr7-jx25.