Central Authentication Service CVE-2025-11284

Q: What is the CVSS score of CVE-2025-11284?

CVE-2025-11284 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Credentials Management Errors (CWE-255)

2025-10-05 cna@vuldb.com

PHP Authentication Bypass

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Remote, unauthenticated, low complexity; low impacts due to limited Git functionality access.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 19:06 vuln.today

DescriptionCVE.org

A vulnerability has been found in Zytec Dalian Zhuoyun Technology Central Authentication Service 3. Affected by this vulnerability is an unknown functionality of the file /index.php/auth/Ops/git of the component HTTP Header Handler. The manipulation of the argument Authorization leads to use of hard-coded password. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Hard-coded password vulnerability in Zytec Dalian Zhuoyun Technology Central Authentication Service version 3 allows remote unauthenticated attackers to bypass authentication for the Git endpoint via a crafted Authorization header. Publicly available exploit code exists, but no patch has been released and the vendor has not responded. Despite a moderate CVSS base score, the EPSS probability is low (0.05%) and there is no evidence of active exploitation in CISA KEV.

Technical ContextAI

The vulnerable product is a PHP-based central authentication service designed to manage user credentials across applications. The flaw resides in the HTTP header handler for the file /index.php/auth/Ops/git, which processes the Authorization header using a hard-coded password (CWE-255). This password is embedded in the server-side code, allowing anyone who knows it (or extracts it from the public exploit) to authenticate as an authorized user for that specific endpoint. The CPE for this product is not provided in the available data, but the product name and version (3) are confirmed.

Affected ProductsAI

Zytec Dalian Zhuoyun Technology Central Authentication Service version 3 is affected. No version range is specified; only version 3 is mentioned in the description. The product is likely deployed on internal or external networks as a central authentication gateway. References: https://vuldb.com/?id.327042 and https://vuldb.com/?ctiid.327042.

RemediationAI

No vendor-released patch identified at time of analysis. As a workaround, disable the vulnerable endpoint /index.php/auth/Ops/git by removing or renaming the file, or block HTTP requests to that path via a web application firewall (WAF) or reverse proxy. Additionally, restrict network access to the Central Authentication Service to trusted IP ranges only. These mitigations may break legitimate functionality that depends on the Git authentication handler. There is no official advisory link from the vendor.