What is the CVSS score of CVE-2025-1928?

CVE-2025-1928 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2025-1928?

Within 24 hours: Audit logs for brute-force authentication attempts against the Restajet system and disable external network access if operationally feasible. Within 7 days: Implement rate-limiting and account lockout policies at the application or WAF layer; enforce password reset for all users; enable multi-factor authentication if supported. Within 30 days: Contact Restajet for explicit patch availability timeline; evaluate alternative vendors if no patched version is released within 60 days; implement continuous authentication monitoring and alerting for anomalous login patterns.

CVE-2025-1928

CRITICAL

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2025-12-19 iletisim@usom.gov.tr

Information Disclosure

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 08:22 vuln.today

CVE Published

Dec 19, 2025 - 13:16 nvd

CRITICAL 9.1

DescriptionCVE.org

Improper Restriction of Excessive Authentication Attempts vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Password Recovery Exploitation.This issue affects Online Food Delivery System: through 19122025. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

The Online Food Delivery System by Restajet Information Technologies through version 19122025 fails to restrict repeated authentication attempts, enabling password recovery exploitation and unauthorized account access. With a CVSS score of 9.1 (critical severity) and unauthenticated network-based attack vector, attackers can brute-force credentials without lockout mechanisms. No public exploit is identified at time of analysis, with EPSS probability at 0.07% (22nd percentile). The vendor did not respond to early disclosure attempts by Turkey's national CERT (USOM).

Technical ContextAI

This vulnerability stems from CWE-307 (Improper Restriction of Excessive Authentication Attempts), a security weakness where authentication mechanisms fail to implement rate limiting, account lockout, or CAPTCHA challenges. The affected product is Restajet's Online Food Delivery System (CPE: cpe:2.3:a:restajet:online_food_delivery_system:-:*:*:*:*:*:*:*) through version identified as 19122025. Without throttling controls on password reset or login endpoints, the system permits unlimited authentication attempts, allowing attackers to enumerate valid credentials through automated brute-force or dictionary attacks. This is particularly critical in food delivery systems which often handle payment information and personal data.

RemediationAI

No vendor-released patch identified at time of analysis, as Restajet Information Technologies did not respond to disclosure attempts. Until official updates are available, implement compensating controls: deploy web application firewall (WAF) rules to rate-limit authentication and password reset endpoints to 3-5 attempts per IP per hour, enforce strong password policies requiring minimum 12-character complexity, implement CAPTCHA on login and password recovery forms after failed attempts, enable multi-factor authentication if the system supports it, and monitor authentication logs for brute-force patterns. Consider network-level access restrictions limiting the application to trusted IP ranges if feasible. Organizations should evaluate alternative food delivery platforms given vendor unresponsiveness. Reference Turkey USOM advisory at https://www.usom.gov.tr/bildirim/tr-25-0469 and VulDB entry at https://vuldb.com/?id.337609 for additional context.