CVE-2025-1928
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2Description
Improper Restriction of Excessive Authentication Attempts vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Password Recovery Exploitation.This issue affects Online Food Delivery System: through 19122025. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Analysis
The Online Food Delivery System by Restajet Information Technologies through version 19122025 fails to restrict repeated authentication attempts, enabling password recovery exploitation and unauthorized account access. With a CVSS score of 9.1 (critical severity) and unauthenticated network-based attack vector, attackers can brute-force credentials without lockout mechanisms. No public exploit is identified at time of analysis, with EPSS probability at 0.07% (22nd percentile). The vendor did not respond to early disclosure attempts by Turkey's national CERT (USOM).
Technical Context
This vulnerability stems from CWE-307 (Improper Restriction of Excessive Authentication Attempts), a security weakness where authentication mechanisms fail to implement rate limiting, account lockout, or CAPTCHA challenges. The affected product is Restajet's Online Food Delivery System (CPE: cpe:2.3:a:restajet:online_food_delivery_system:-:*:*:*:*:*:*:*) through version identified as 19122025. Without throttling controls on password reset or login endpoints, the system permits unlimited authentication attempts, allowing attackers to enumerate valid credentials through automated brute-force or dictionary attacks. This is particularly critical in food delivery systems which often handle payment information and personal data.
Affected Products
Restajet Information Technologies Inc. Online Food Delivery System versions through 19122025 are affected, as confirmed via CPE identifier cpe:2.3:a:restajet:online_food_delivery_system:-:*:*:*:*:*:*:*. The disclosure was reported by Turkey's National Cyber Incident Response Center (USOM) at [email protected] with details published at https://www.usom.gov.tr/bildirim/tr-25-0469. No specific earlier version boundary was documented, suggesting all versions up to and including the December 19, 2025 build are vulnerable. The vendor did not respond to early disclosure attempts, leaving remediation guidance uncertain.
Remediation
No vendor-released patch identified at time of analysis, as Restajet Information Technologies did not respond to disclosure attempts. Until official updates are available, implement compensating controls: deploy web application firewall (WAF) rules to rate-limit authentication and password reset endpoints to 3-5 attempts per IP per hour, enforce strong password policies requiring minimum 12-character complexity, implement CAPTCHA on login and password recovery forms after failed attempts, enable multi-factor authentication if the system supports it, and monitor authentication logs for brute-force patterns. Consider network-level access restrictions limiting the application to trusted IP ranges if feasible. Organizations should evaluate alternative food delivery platforms given vendor unresponsiveness. Reference Turkey USOM advisory at https://www.usom.gov.tr/bildirim/tr-25-0469 and VulDB entry at https://vuldb.com/?id.337609 for additional context.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today