Ragic Cloud Database CVE-2025-15016

No special configuration required - the cryptographic key is hard-coded in the product, so any internet- or network-reachable instance of Ragic Enterprise Cloud Database is exploitable by an unauthenticated attacker against default deployments (AV:N/AC:L/PR:N/UI:N). The only practical limiting factor is network reachability of the application's login/verification endpoint; an attacker must be able to reach the service, and must know or recover the fixed key (trivial once published or reverse-engineered). No user interaction, prior authentication, or non-default setting is needed.

This is a genuinely high-priority flaw, and the signals are largely consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, score 9.3) describes a network-reachable, low-complexity, unauthenticated vulnerability with full compromise of confidentiality, integrity, and availability - matching the description of a hard-coded cryptographic key (CWE-321) that lets an attacker forge verification data and authenticate as any user, i.e. complete authentication bypass and account takeover. The one notable tension is the EPSS score: 0.53% (43rd percentile) is low-to-moderate and does not reflect the ease implied by the CVSS vector. This divergence is expected for a freshly disclosed vulnerability in a niche vendor product - EPSS has little observed exploitation data yet and should not be read as evidence the flaw is hard to exploit. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed active exploitation; however, hard-coded-key bypasses are typically trivial to weaponize once the key is extracted, so the gap between 'no public PoC' and 'exploitable' may close quickly. Net: treat as a serious patch-now issue for anyone running Ragic Enterprise Cloud Database, while recognizing the real-world blast radius is bounded by the product's limited deployment footprint.

A remote, unauthenticated attacker who can reach the Ragic Enterprise Cloud Database web interface uses the publicly fixed (hard-coded) cryptographic key to generate valid verification information for an arbitrary account. Because the key is identical across installations, the attacker crafts a forged authentication token and logs in as any user - including administrators - without credentials. No public exploit code is identified at time of analysis, but exploitation requires only network access to the application.