Vulnerability · Published Jul 22, 2025 · Assigned by VulnCheck
CVE-2025-34143ETQ Reliance CG Authentication Bypass via Trailing Space RCE
Critical 9.3
In plain English
A critical-severity authentication bypass in Reliance CG (legacy) from ETQ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 38.0% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login page to obtain elevated access. Once authenticated, an attacker could achieve remote code execution by modifying Jython scripts within the application. This issue was resolved by introducing stricter validation logic to exclude internal accounts from public authentication workflows in version MP-4583.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ETQ | Reliance CG (legacy) | 0 – before MP-4583 |
Weakness: CWE-288, CWE-269, CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://www.etq.com/product-overview/ product
- https://www.etq.com/blog/etq-reliance-security-update/ vendor-advisory, patch
- https://slcyber.io/assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-etq-reliance/ technical-description
- https://www.vulncheck.com/advisories/etq-reliance-cg-authentication-bypass-via-trailing-space-rce third-party-advisory