CRITICAL 9.3 NVD
CVE-2025-71457
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.p
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.
References
- https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/
- https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/
- https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25021-release-note
- https://www.vulncheck.com/advisories/vtenext-25.02-before-25.02.1-unverified-password-chan
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-11-04 via NVD.
Risk Timeline
CVE Disclosed2026-11-04 · 0 days ago
Remediation Resources
Analysis & PoC
0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/
vulnfeed aggregates 16578 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.