What is the CVSS score of CVE-2025-40718?

CVE-2025-40718 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Quiter Gateway are affected by CVE-2025-40718?

CVE-2025-40718 affects Quiter Gateway versions prior to 4.7.0 and enables attackers to extract sensitive information through crafted error messages, potentially exposing system configuration details…. A patch is available.

How to fix or mitigate CVE-2025-40718?

Within 24 hours: inventory all Quiter Gateway deployments and identify instances running versions prior to 4.7.0. Within 7 days: apply vendor-released patch to upgrade Quiter Gateway to version 4.7.0 or later across all affected systems. Within 30 days: conduct audit of error logs and monitoring to detect whether malformed payloads have been sent to your gateways; review any sensitive information that may have been exposed in error responses.

Quiter Gateway CVE-2025-40718

EUVD-2025-20459 HIGH

Error Message Information Leak (CWE-209)

2025-07-08 cve-coordination@incibe.es

Information Disclosure Quiter Gateway

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:33 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.7.0

EUVD ID Assigned

Mar 16, 2026 - 04:21 euvd

EUVD-2025-20459

Analysis Generated

Mar 16, 2026 - 04:21 vuln.today

CVE Published

Jul 08, 2025 - 12:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper error handling vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to send malformed payloads to generate error messages containing sensitive information.

Analysis

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Error Message Information Leak (CWE-209).