What is the CVSS score of CVE-2025-4319?

CVE-2025-4319 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H. EPSS exploitation probability: 0.1%.

Which versions of Birebirsoft Software are affected by CVE-2025-4319?

A critical vulnerability in Birebirsoft solutions allows attackers to bypass authentication controls through brute-force attacks without rate limiting, potentially compromising user accounts and…

How to fix or mitigate CVE-2025-4319?

Within 24 hours: Identify all systems running Birebirsoft software and assess exposure; enable enhanced logging for authentication attempts and review recent access logs for suspicious activity. Within 7 days: Implement network-based rate limiting and account lockout policies; isolate affected systems from critical networks if feasible; contact Birebirsoft for patch timelines and temporary workarounds. Within 30 days: Apply vendor patch immediately upon availability; conduct forensic review of authentication logs; reset credentials for privileged accounts; implement multi-factor authentication if not already enabled.

Birebirsoft Software CVE-2025-4319

CRITICAL

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-01-23 iletisim@usom.gov.tr

Information Disclosure

9.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 13:15 nvd

CRITICAL 9.4

DescriptionCVE.org

Improper Restriction of Excessive Authentication Attempts, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Brute Force, Password Recovery Exploitation.This issue affects Sufirmam: through 23012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A product by Birebir has weak authentication with improper rate limiting on login attempts and insecure password recovery, enabling brute-force attacks and account takeover.

Technical ContextAI

CWE-307 improper restriction of excessive authentication attempts combined with weak password recovery allows attackers to brute-force credentials without lockout and exploit the password reset mechanism.