Actiontech SQLE CVE-2025-15107

Exploitation requires: (1) Network access to an Actiontech SQLE service or API endpoint that validates JWT tokens (AV:N confirms remote accessibility). (2) Knowledge or derivation of the hard-coded JWTSecretKey value, which is embedded in the application code or binary-this is the primary obstacle contributing to high attack complexity (AC:H). (3) SQLE must be configured to use JWT authentication; if JWT is disabled or replaced with alternative auth, this vulnerability is not exploitable. (4) No authentication is required by the attacker to attempt token forgery (PR:N), but the attacker must successfully reverse-engineer or obtain the key. The vulnerability does NOT require user interaction (UI:N). Attack complexity is high because deriving the hard-coded key from compiled code, source code repositories, or configuration files requires reverse engineering, code review, or insider knowledge-not trivial network manipulation. If SQLE is deployed without internet-facing JWT endpoints or behind a network boundary preventing external access, the practical risk is significantly reduced despite the AV:N vector.

This vulnerability presents LOW real-world risk despite publicly available exploit code. CVSS v4.0 score of 2.9 reflects the high attack complexity (AC:H) and limited impact (VC:L, information disclosure only). EPSS score of 0.02% (5th percentile) confirms very low exploitation likelihood in the wild, suggesting the attack requires specific knowledge or circumstances not widely applicable. The CVSS vector shows AV:N (network-accessible) but no escalation of impact beyond confidentiality (VC:L with VI:N, VA:N), meaning successful exploitation does not lead to code execution, data modification, or availability impact. The E:P (Exploit Proven) tag indicates public disclosure but does NOT equate to active widespread exploitation. The mismatch between 'publicly available' exploit and 0.02% EPSS suggests the PoC may be theoretical or require non-trivial setup. Attack complexity being 'high' implies attackers must overcome significant obstacles (likely deriving or guessing the hard-coded key). For defenders: prioritize patching only if SQLE deployments handle sensitive JWT operations; low EPSS and limited impact reduce urgency relative to critical CVEs.

An attacker discovers or reverse-engineers the hard-coded JWTSecretKey from Actiontech SQLE's source code or compiled binary. Using this key, the attacker constructs a forged JWT token with elevated privileges or impersonates a legitimate user, then submits the token via HTTP to a SQLE service endpoint (e.g., API gateway, web UI). If the JWT validation logic accepts the hard-coded key without additional checks, the token is validated and the attacker gains access to functions or data associated with the impersonated identity, resulting in information disclosure.