Log in Start free

Vulnerability · Published Dec 28, 2025 · Assigned by VulDB

CVE-2025-15141Halo Configuration actuator information disclosure

Low 3.1

In plain English

A low-severity information exposure in Halo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.3%top 83.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler. Executing a manipulation can lead to information disclosure. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
n/a Halo 2.21.02.21.12.21.22.21.32.21.42.21.52.21.62.21.7

Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R

References