CVE-2025-9313 Unauthorized database access in Asseco mMedica
Unauthenticated attackers can bypass authentication to gain full access to the database, exposing sensitive data in Asseco mMedica.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-9313?
CVE-2025-9313 is a critical authentication bypass vulnerability in Asseco Poland S.A. mMedica, published on 28 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through a "mmBackup" application. This flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to database with sensitive data.
This issue affects Asseco mMedica in versions before 11.9.5.
Weakness: CWE-288
Which versions are affected by CVE-2025-9313?
How do I fix CVE-2025-9313?
No fix has been published for CVE-2025-9313 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-9313 being exploited?
There is no known exploitation of CVE-2025-9313 in the wild and no public exploit code.
Sources
Also known as GHSA-85v2-7wpp-wgf5.