What is the CVSS score of CVE-2025-60949?

CVE-2025-60949 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2025-60949?

Yes, a public proof-of-concept exploit is available for CVE-2025-60949. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-60949?

Within 24 hours: Identify all Census CSWeb instances running versions prior to 8.1.0 alpha and verify network accessibility of the /app/config endpoint. Within 7 days: Apply vendor patch by upgrading Census CSWeb to version 8.1.0 alpha or later on all affected instances; confirm patch deployment through version verification. Within 30 days: Conduct credential rotation audit for all secrets previously exposed through the /app/config endpoint and review access logs for unauthorized configuration data retrieval.

Csweb CVE-2025-60949

Q: Which versions of Csweb are affected by CVE-2025-60949?

Census CSWeb versions prior to 8.1.0 alpha expose sensitive configuration data and secrets through an unauthenticated HTTP endpoint, creating immediate risk of credential compromise and lateral…. A patch is available.

EUVD-2025-208954 CRITICAL

Information Exposure (CWE-200)

2026-03-23 cisa-cg

GHSA-2926-f789-68jv

Information Disclosure Csweb Census

9.3

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	This represents a high-priority real-world risk despite limited EPSS or KEV data being provided. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network-based exploitation with low complexity, no privileges required, and no user interaction needed, making this highly automatable. The availability of a public proof-of-concept exploit (github.com/hx381/cspro-exploits) significantly elevates the risk by lowering the barrier to exploitation. The high confidentiality and integrity impact combined with leaked secrets could enable attackers to pivot to database compromise, data manipulation, or complete application takeover. Organizations using CSWeb in internet-facing deployments or environments where attackers have network access should treat this as an urgent remediation priority. The fact that CISA's Cybersecurity and Infrastructure Security Agency reported this (reported by: cisa-cg) and published a CSAF advisory suggests active concern from government security agencies.
Exploit ScenarioDerived	A remote attacker with network access to a vulnerable CSWeb instance crafts HTTP requests targeting the app/config endpoint without any authentication. Using techniques documented in the public proof-of-concept (https://github.com/hx381/cspro-exploits), the attacker retrieves configuration files containing database credentials, API keys, session secrets, and other sensitive parameters. With these leaked credentials, the attacker gains unauthorized access to the backend database, exfiltrates sensitive census or survey data, and potentially modifies records to compromise data integrity.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 23, 2026

Census CSWeb 8.0.1 contains an information disclosure vulnerability where the app/config endpoint is reachable via HTTP without authentication in certain deployments, allowing remote attackers to retrieve sensitive configuration data including secrets. This vulnerability has a CVSS score of 9.1 (Critical) and affects Census CSWeb versions prior to 8.1.0 alpha. A public proof-of-concept exploit is available on GitHub (https://github.com/hx381/cspro-exploits), significantly increasing the risk of active exploitation.

RemediationAI

Immediately upgrade Census CSWeb to version 8.1.0 alpha or later, which addresses this vulnerability as documented in the GitHub commit at https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91. Until patching is complete, implement immediate compensating controls including configuring web server or reverse proxy rules to explicitly deny access to the app/config path for all external requests, restricting CSWeb access to trusted IP ranges only via firewall rules, and ensuring the application is not directly exposed to the internet. Review application configuration files for any exposed secrets and rotate all credentials, API keys, and tokens that may have been accessible through this vulnerability. Consult the CISA CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-082-01.json for additional guidance and consider implementing network segmentation to isolate CSWeb instances from untrusted networks.

Affected VersionsENISA

CSWeb 8.0.1 <8.1.0 alpha

CSWeb patch: 8.1.0 alpha

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Census CSWeb is a web-based data dissemination system for census and survey data. The vulnerability affects CSWeb version 8.0.1 (CPE: cpe:2.3:a:census:csweb:*:*:*:*:*:*:*:*) and stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The root cause is improper access control on the app/config directory structure, which allows HTTP requests to reach configuration files that should be restricted. In certain deployment configurations, these configuration endpoints are exposed to the network without requiring authentication, enabling unauthorized access to potentially sensitive application settings, database credentials, API keys, and other secrets stored in configuration files.

Know when Csweb gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:49 EUVD-patch-fix

executive summary

Patch available

Apr 16, 2026 - 05:29 EUVD

8.1.0

PoC Detected

Mar 25, 2026 - 21:06 vuln.today

Public exploit code

CVE Published

Mar 23, 2026 - 21:00 nvd

CRITICAL 9.3

DescriptionCVE.org

Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.

Articles & Coverage 1

vuln.today Threat Landscape 23/03-30/03/2026: Supply Chain Attacks and Auth Failures Surge Mar 30, 2026

Executive ViewAI

Why It Matters

Census CSWeb versions prior to 8.1.0 alpha expose sensitive configuration data and secrets through an unauthenticated HTTP endpoint, creating immediate risk of credential compromise and lateral movement across connected systems. Organizations running affected Census CSWeb deployments face potential unauthorized access to infrastructure secrets and API credentials without any authentication barrier, requiring urgent patching to prevent data exfiltration.

Business Impact: Severe

Compensating Controls

Apply vendor patch (Census CSWeb version 8.1.0 alpha or later). Interim mitigations if patch cannot be immediately applied: implement network-level access controls to restrict HTTP access to the /app/config endpoint to authorized internal networks only; disable or firewall the endpoint at the load balancer or WAF layer; monitor access logs for requests to /app/config and immediately rotate exposed credentials.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.