Epsilon RH CVE-2025-12461
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing Epsilon RH instance
-
ExploitRequest unprotected /epsilonnet/License/About.aspx
-
ExecutionReceive license and installed-module data
-
ImpactFingerprint deployment for targeted follow-up
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential protection in transit/storage
|
| Exploitation Conditions | Exploitation requires only network reachability to an Epsilon RH web deployment and a direct HTTP request to the specific unprotected path '…/epsilonnet/License/About.aspx', which lacks any access-control enforcement; no authentication, credentials, or user interaction are needed (PR:N/UI:N). The practical limiting factors are: the attacker must be able to reach the Epsilon RH instance (exposure is reduced for internal-only/VPN-gated deployments), and the disclosed data is limited to licensing information and the set of installed modules - useful for reconnaissance but not directly granting access or code execution. Impact is further bounded by VC:L with no integrity or availability effect. |
| Impact | This is a moderate-severity information disclosure (CWE-522) in Epsilon RH by Grupo Castilla, rated CVSS 4.0 6.9. All signals point to a low-to-moderate real-world priority rather than an urgent threat. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated vector requiring no user interaction, which inflates the score, but the actual impact is narrow: VC:L with VI:N/VA:N and no scope change (SC:N) means only limited confidentiality exposure - license details and which product modules are installed - with no integrity or availability consequences. EPSS is low at 0.30% (21st percentile), there is no CISA KEV listing, and no public exploit was identified, so there is no indication of active or imminent widespread exploitation. The signals are internally consistent: a genuinely unauthenticated-but-low-impact disclosure. No SSVC decision data was provided in the input. The main caveat is that the leaked configuration/module data is primarily useful for reconnaissance to enable follow-on targeting rather than being damaging on its own. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach an internet-facing Epsilon RH instance requests the unprotected path '.../epsilonnet/License/About.aspx' directly and receives licensing details and the list of installed product modules. This reconnaissance lets the attacker fingerprint the deployment and tailor subsequent attacks against the specific modules in use. No public exploit code is required - a simple HTTP GET to the known path suffices. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Unauthenticated information disclosure in Epsilon RH (Grupo Castilla) allows remote attackers to retrieve license details and the set of installed modules by directly requesting the unprotected '/epsilonnet/License/About.aspx' path. The vulnerability is rated CVSS 4.0 6.9 (moderate) and requires only network reachability to an exposed Epsilon RH web deployment, with no authentication or user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS is low at 0.30% (percentile 21%).
RemediationAI
No vendor-released patch has been identified at time of analysis. Apply the latest updates from Grupo Castilla as referenced in the INCBE advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/unprotected-access-parts-application-epsilon-rh-grupo-castilla). As a compensating control, configure ASP.NET authorization rules to require authentication for the '/epsilonnet/License/' directory (e.g., add a <deny users="?"/> rule in web.config or IIS URL Authorization), which effectively blocks anonymous access to About.aspx; side effect: legitimate administrators must authenticate to view license details. Alternatively, restrict network access to the Epsilon RH web server using firewall rules or a VPN, blocking public internet exposure of the vulnerable endpoint; this reduces reachability but may impact remote workforce access. Monitor web server logs for requests to '/epsilonnet/License/About.aspx' as an indicator of scanning or exploitation attempts. Avoid placing the license page in a publicly accessible location if it is not required for external users.
Affected ProductsAI
Epsilon RH by Grupo Castilla is the affected product. No specific version range or CPE identifier is provided in the available data; all deployments exposing the '/epsilonnet/License/About.aspx' path without access restrictions are potentially vulnerable. The vendor advisory from INCBE-CERT (https://www.incibe.es/en/incibe-cert/notices/aviso/unprotected-access-parts-application-epsilon-rh-grupo-castilla) should be consulted for exact version details and patch information. The vulnerability affects the web application component; exposure is reduced for instances accessible only via internal networks or VPNs.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Epsilon RH is an ASP.NET-based human resources management suite by Grupo Castilla. The vulnerable page, '/epsilonnet/License/About.aspx', is part of the application's licensing and configuration display functionality. The root cause aligns with CWE-522 (Insufficiently Protected Credentials/Configuration Data): the page fails to enforce any access-control check, allowing any remote user who can reach the web server to view licensing information and enumerate installed modules. In ASP.NET applications, authorization is typically enforced via web.config <authorization> rules or code-level checks; here, the path is likely omitted from such protections, effectively making it public. The disclosed information-product edition, license status, and module list-is useful for reconnaissance (e.g., identifying exploitable modules) but does not directly grant access or code execution, and there is no integrity or availability impact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) and independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) both reflect a low-confidentiality-impact, network-reachable information leak.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network access to an unprotected page (AV:N/AC:L/PR:N/UI:N); only limited confidential license/config data is exposed (C:L), with no integrity or availability impact.
Primary rating from Vendor (incibe).
CVSS VectorVendor: incibe
DescriptionCVE.org
This vulnerability allows an attacker to access parts of the application that are not protected by any type of access control. The attacker could access this path ‘…/epsilonnet/License/About.aspx’ and obtain information on both the licence and the configuration of the product by knowing which modules are installed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB