Gatemanager CVE-2025-14716

The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates a medium-to-high severity issue with network accessibility, low attack complexity, and low privilege requirements (an attacker must already be authenticated). The confidentiality impact is high, but integrity and availability are unaffected. The key differentiator is the PR:L requirement—this is not a zero-day unauthenticated bypass but rather a privilege escalation or lateral access flaw affecting existing users. Without published EPSS data or KEV inclusion status, the real-world priority depends on the prevalence of GateManager deployments and whether active exploitation has been observed in the wild. The attack is non-interactive (UI:N), making it suitable for automated exploitation by insiders or compromised accounts. Organizations running GateManager should prioritize patching based on their exposure and data sensitivity, particularly if the product manages critical industrial control or remote access infrastructure.

An attacker with a standard user account on GateManager gains access to the system through credential theft or insider action. By crafting a specially formed request to the webserver's authentication module or manipulating their session token, the attacker bypasses permission checks and accesses sensitive administrative data or configurations without proper authorization. Since the attack requires network access and an authenticated account but has low complexity, an insider or attacker with a compromised standard account could exploit this repeatedly and covertly.