Zytec Central Authentication Service CVE-2025-12266

Q: What is the CVSS score of CVE-2025-12266?

CVE-2025-12266 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-27 cna@vuldb.com

PHP Code Injection

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:31 vuln.today

DescriptionCVE.org

A vulnerability was detected in Zytec Dalian Zhuoyun Technology Central Authentication Service up to 20251009. This vulnerability affects the function _empty of the file /index.php/auth/widget. Performing manipulation of the argument get.layer/get.widget/get.action results in code injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Code injection in Zytec Dalian Zhuoyun Technology Central Authentication Service up to version 20251009 allows authenticated remote attackers to inject arbitrary code via manipulation of the get.layer, get.widget, and get.action parameters in the /index.php/auth/widget endpoint. Public exploit code is available, but real-world exploitation risk is low given the low CVSS score (2.1), requirement for prior authentication, and extremely low EPSS score (0.04%), suggesting limited practical exploitability despite proof-of-concept availability.

Technical ContextAI

The vulnerability exists in the _empty function within the /index.php/auth/widget file of a PHP-based central authentication service. The root cause is improper neutralization of special elements used in an expression (CWE-74), where user-supplied input from the get.layer, get.widget, and get.action parameters is not properly sanitized before being used in code execution contexts. Central authentication services are critical infrastructure components that manage user identity verification and session management across enterprise systems, making even low-severity code injection in such systems worthy of attention despite the CVSS score.

Affected ProductsAI

Zytec Dalian Zhuoyun Technology Central Authentication Service versions up to and including 20251009 are confirmed affected based on the vulnerability report. The exact CPE string is not provided in available references, but the affected component is specifically the /index.php/auth/widget endpoint. No later patched versions are documented in the provided data.

RemediationAI

Immediate vendor contact for a security update is the primary recommended action; however, given the vendor's reported non-responsiveness to disclosure, organizations should implement interim mitigations. Restrict network access to the Central Authentication Service endpoint (/index.php/auth/widget) to trusted internal networks or trusted IP ranges only, using firewall rules or reverse proxy authentication. Implement input validation and sanitization on the get.layer, get.widget, and get.action parameters at the application or WAF level to block injection payloads; specific payload patterns should be developed based on the publicly available exploit code. Monitor authentication logs for suspicious parameter values or injection attempts. Disable or restrict access to this service if it is not actively required, and consider migrating to an alternative authentication service if the vendor remains unresponsive. Side effect: network restrictions may impact legitimate remote users; WAF rules may cause false positives requiring tuning.