Vulnerability · Published Mar 20, 2025 · Assigned by TR-CERT

CVE-2025-2311Authentication Bypass in Sechard Information Technologies' SecHard

Critical 9.0

In plain English

A critical-severity security flaw in SecHard from Sechard Information Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)0.2%top 93.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harvesting Information via API Event Monitoring. This issue affects SecHard: before 3.3.0.20220411.

Affected products (as reported)

Vendor	Product	Versions
Sechard Information Technologies	SecHard	0 – before 3.3.0.20220411

Weakness: CWE-648, CWE-319, CWE-522 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://www.usom.gov.tr/bildirim/tr-25-0074 government-resource, broken-link
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0074 government-resource