What is the CVSS score of CVE-2025-4320?

CVE-2025-4320 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Birebirsoft Software are affected by CVE-2025-4320?

A critical vulnerability (CVSS 10.0) exists in Birebirsoft Sufirmam with no available patch, potentially allowing complete system compromise.

How to fix or mitigate CVE-2025-4320?

Within 24 hours: Identify all systems running Birebirsoft Sufirmam and isolate them from critical networks; escalate to vendor for emergency patch timeline. Within 7 days: Implement network segmentation, disable non-essential features if possible, and deploy WAF rules to block known attack vectors. Within 30 days: Evaluate alternative solutions, establish vendor communication protocol for patch delivery, and conduct full risk assessment.

Birebirsoft Software CVE-2025-4320

CRITICAL

Authentication Bypass by Primary Weakness (CWE-305)

2026-01-23 iletisim@usom.gov.tr

Authentication Bypass

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 13:15 nvd

CRITICAL 10.0

DescriptionCVE.org

Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Authentication Bypass, Password Recovery Exploitation.This issue affects Sufirmam: through 23012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A Birebir product has a CVSS 10.0 authentication bypass through a primary weakness in the password recovery mechanism, allowing complete account takeover without any authentication.

Technical ContextAI

CWE-305 authentication bypass by primary weakness in the password recovery mechanism allows unauthenticated attackers to reset any account's password and gain access without knowing the original credentials.