What is the CVSS score of CVE-2025-5192?

CVE-2025-5192 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Hr Portal are affected by CVE-2025-5192?

CVE-2025-5192 affects Soar Cloud HRD Human Resource Management System versions through 7.3.2025.0408, allowing unauthenticated remote attackers to bypass login controls and access sensitive HR…

How to fix or mitigate CVE-2025-5192?

Within 24 hours: Isolate affected Soar Cloud HRD instances from the internet or restrict access to known trusted networks only; audit access logs for unauthorized activity and suspicious login patterns. Within 7 days: Implement network segmentation to limit lateral movement; deploy Web Application Firewall (WAF) rules to block unauthenticated requests to critical HR functions; conduct forensic review of recent access logs. Within 30 days: Contact Soar Cloud for patch availability and apply immediately upon release; perform full security assessment of HR system and related integrations; reset credentials for all administrative accounts.

Hr Portal CVE-2025-5192

EUVD-2025-17103 HIGH

Missing Authentication for Critical Function (CWE-306)

2025-06-06 ART@zuso.ai

Authentication Bypass Hr Portal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17103

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 10:15 nvd

HIGH 7.5

DescriptionCVE.org

A missing authentication for critical function vulnerability in the client application of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to bypass authentication and access application functions.

AnalysisAI

Missing authentication vulnerability in Soar Cloud HRD Human Resource Management System versions up to 7.3.2025.0408 that allows unauthenticated remote attackers to bypass authentication controls and access critical application functions. The vulnerability has a CVSS score of 7.5 (High) with high confidentiality impact, indicating attackers can read sensitive HR data without credentials. While specific KEV or active exploitation status is not confirmed in available data, the network-accessible nature (AV:N), lack of authentication requirement (PR:N), and criticality of HR systems suggest elevated real-world risk.

Technical ContextAI

This vulnerability stems from CWE-306 (Missing Authentication for Critical Function), a design flaw where critical operations in the Soar Cloud HRD client application lack proper authentication mechanisms. The affected product is a cloud-based Human Resource Management System, which typically processes sensitive employee data, payroll information, and organizational records. The vulnerability likely exists in API endpoints, web interfaces, or client-server communication channels that fail to validate user identity before exposing critical functions. The CVSS vector indicates the flaw is remotely exploitable over a network (AV:N) with low attack complexity (AC:L), meaning no special conditions or tools are required—attackers can exploit this through standard HTTP/HTTPS requests without authentication headers or session tokens.

RemediationAI

Immediate actions: (1) Apply the latest security patch from Soar Cloud—contact vendor support or check https://[vendor-security-portal] for version 7.3.2025.0409 or newer; (2) If patches are unavailable, implement network-level access controls: restrict client application access to authenticated internal networks only, use a WAF to enforce authentication headers on all API endpoints, and require VPN/proxy authentication; (3) Conduct a data access audit to determine if the vulnerability has been exploited—review application logs, API access logs, and data export patterns for unauthorized access; (4) Disable or restrict access to non-essential critical functions until patched; (5) Implement API gateway authentication enforcement as a temporary mitigation. Long-term: update to version 7.4 or later once released with confirmed fixes, and implement security code review processes to prevent CWE-306 issues in future releases.