What is the CVSS score of CVE-2025-14349?

CVE-2025-14349 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Flexcity are affected by CVE-2025-14349?

FlexCity/Kiosk versions prior to 1.0.36 contain a critical privilege escalation vulnerability that allows unauthorized users to bypass access controls and gain elevated system privileges.

How to fix or mitigate CVE-2025-14349?

Within 24 hours: Audit all FlexCity/Kiosk installations to identify affected versions (1.0 through 1.0.35) and document business-critical systems. Within 7 days: Implement network segmentation to restrict kiosk access, disable non-essential administrative functions if operationally feasible, and enforce strict authentication requirements for privileged operations. Within 30 days: Upgrade to FlexCity/Kiosk 1.0.36 or later once available, or migrate to an alternative solution if upgrade timeline is uncertain.

Flexcity CVE-2025-14349

HIGH

Privilege Defined With Unsafe Actions (CWE-267)

2026-02-13 iletisim@usom.gov.tr

Authentication Bypass Privilege Escalation Flexcity Uni Yaz

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 13, 2026 - 14:16 nvd

HIGH 8.8

DescriptionCVE.org

Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Functionality Not Properly Constrained by ACLs, Privilege Escalation.This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.

AnalysisAI

Technical ContextAI

Affects Flexcity. Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Functionality Not Properly Constrained by ACLs, Privilege Escalation.This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.