Vulnerability · Published Oct 5, 2025 · Assigned by VulDB
CVE-2025-11284Zytec Dalian Zhuoyun Technology Central Authentication Service HTTP Header git hard-coded password
High 7.3
In plain English
A high-severity security flaw in Central Authentication Service from Zytec Dalian Zhuoyun Technology. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
A vulnerability has been found in Zytec Dalian Zhuoyun Technology Central Authentication Service 3. Affected by this vulnerability is an unknown functionality of the file /index.php/auth/Ops/git of the component HTTP Header Handler. The manipulation of the argument Authorization leads to use of hard-coded password. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zytec Dalian Zhuoyun Technology | Central Authentication Service | 3 |
Weakness: CWE-259, CWE-255 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R
References
- VDB-327042 | Zytec Dalian Zhuoyun Technology Central Authentication Service HTTP Header git hard-coded password vdb-entry, technical-description
- VDB-327042 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #659701 | https://www.zytec.cn Central Authentication Service 3 Command Injection third-party-advisory
- http://101.200.76.102:38765/qwertyuiop/qwsdfvbnm/1/vuldb/fbnoABGFBEGPcvgmowepgokwj293t0-23t202jk9t0.html exploit