Vulnerability · Published Jul 22, 2025 · Assigned by VulnCheck

CVE-2025-34140ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix

High 8.7

In plain English

A high-severity authorization bypass via user-controlled key in Reliance CG (legacy) from ETQ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.7%top 47.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An authorization bypass vulnerability exists in ETQ Reliance (legacy CG and NXG SaaS platforms). By appending a specific URI suffix to certain API endpoints, an unauthenticated attacker can bypass access control checks and retrieve limited sensitive resources. The root cause was a misconfiguration in API authorization logic, which has since been corrected in SE.2025.1 and 2025.1.2.

Affected products (as reported)

Vendor	Product	Versions
ETQ	Reliance CG (legacy)	0 – before SE.2025.1
ETQ	Reliance NXG (SaaS)	0 – before 2025.1.2

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://www.etq.com/product-overview/ product
https://www.etq.com/blog/etq-reliance-security-update/ vendor-advisory, patch
https://www.vulncheck.com/advisories/etq-reliance-cg-nxg-api-authorization-bypass-via-localized-text-uri-suffix third-party-advisory