Pangolin CVE-2025-56333

Exploitation targets the Pangolin two-factor authentication (2FA) component specifically; the attacker must be able to reach the instance's authentication/login interface over the network (AV:N, AC:L per the input vector). The flaw is a 2FA/authentication bypass (CWE-287) enabling privilege escalation, so the realistic prerequisite is a Pangolin deployment with authentication/2FA in use and reachable by the attacker - typically an internet-exposed or network-reachable instance running v1.6.2 or earlier. Limiting factors: only Pangolin ≤ v1.6.2 is affected (upgrading beyond this remediates), and although NVD marks PR:N, the 'privilege escalation via 2FA' framing suggests the attacker may need to reach an authenticated/2FA stage first - defenders should confirm whether valid first-factor credentials are a precondition, as that materially changes real-world exploitability.

The input signals are largely aligned toward high priority but with one notable tension. CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N) describing a remote, low-complexity, unauthenticated attack with full confidentiality, integrity and availability impact. POC/exploit code is publicly available (a referenced GitHub gist), which materially raises the near-term likelihood of opportunistic use. However, no EPSS score, no CISA KEV listing, and no SSVC decision data were supplied, so exploitation status is 'publicly available exploit code exists' - this is distinct from confirmed active exploitation and must not be upgraded to 'in the wild.' The key conflict: the CWE (CWE-287, Improper Authentication) and the description both frame this as 'privilege escalation via the 2FA component,' which normally implies the attacker already holds some foothold (e.g. valid first-factor credentials needed before bypassing the second factor), yet the NVD vector sets PR:N (no privileges). This network-vector-but-escalation framing should be verified with the vendor/source. Net: with public POC code and a critical CVSS against a CWE-287 flaw, this is a real, actionable priority for any Pangolin operator, but the absence of EPSS/KEV means widespread automated exploitation is not yet evidenced - treat as high-urgency patching rather than confirmed mass exploitation.

A remote attacker targets an internet-exposed Pangolin instance (v1.6.2 or earlier) and abuses a flaw in the 2FA component to bypass the second authentication factor and obtain elevated/administrative access. Public exploit code exists (referenced gist), lowering the skill and effort needed. Given the low attack complexity, an attacker reaching the login/2FA endpoint can likely replay the technique against any vulnerable deployment.