Vulnerability · Published May 27, 2025 · Assigned by NCSC.ch

CVE-2025-2407Missing Authentication & Authorization in Web-API allows adversary unrestricted access

Critical 9.3

In plain English

A critical-severity missing authentication in AMX MTAPI from Mobatime. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability is fixed in Version 1.5.

Affected products (as reported)

Vendor	Product	Versions
Mobatime	AMX MTAPI	0 – through 6
Mobatime	AMXGT-100	0 – before 1.5

Weakness: CWE-306, CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U

References

https://mobatimemtsl.github.io/Vulnerability-References/