What is the CVSS score of CVE-2025-54303?

CVE-2025-54303 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2025-54303?

Thermo Fisher Torrent Suite deployments are exposed to critical unauthorized administrative access through unchanged default credentials (ionadmin/ionadmin).

How to fix or mitigate CVE-2025-54303?

Within 24 hours: Inventory all Torrent Suite 5.18.1 instances and verify whether default ionadmin credentials have been changed; disable or rename the ionadmin account if possible. Within 7 days: Force password reset for all administrative accounts with strong policy enforcement; implement multi-factor authentication for administrative access if supported. Within 30 days: Deploy network segmentation to restrict Torrent Suite administrative interfaces to trusted networks only; establish continuous monitoring for unauthorized authentication attempts; conduct access audit to detect any compromise indicators.

Python CVE-2025-54303

EUVD-2025-201180 CRITICAL

Use of Default Credentials (CWE-1392)

2025-12-04 cve@mitre.org

Information Disclosure Python Torrent Suite Software

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201180

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

CVE Published

Dec 04, 2025 - 15:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API. The ionadmin user account can be used to authenticate to default deployments with the password ionadmin. The user guide recommends changing default credentials; however, a password change policy for default administrative accounts is not enforced. Many deployments may retain default credentials, in which case an attacker is likely to be able to successfully authenticate with administrative privileges.

AnalysisAI

A remote code execution vulnerability in Thermo Fisher Torrent Suite Django application 5.18.1 (CVSS 9.8). Critical severity with potential for significant impact on affected systems.

Technical ContextAI

Vulnerability type: remote code execution. CVSS 9.8 indicates critical severity with likely remote exploitation vector. Affects Thermo Fisher Torrent Suite Django application 5.18.1.