What is the CVSS score of CVE-2025-67437?

CVE-2025-67437 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Medical Management System CVE-2025-67437

EUVD-2025-209884 MEDIUM

Improper Access Control (CWE-284)

2026-05-15 cve@mitre.org

GHSA-jqhf-vgh2-rgh2

Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

8.2 HIGH

Arbitrary unauthenticated password reset constitutes full account takeover, warranting I:H; initial access yields low confidentiality impact pending post-login data access.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:08 vuln.today

CVE Published

May 15, 2026 - 15:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure Permissions, which allows arbitrary user password reset.

AnalysisAI

Unauthenticated arbitrary password reset in Medical Management System (commit a81df1ce700a9662cb136b27af47f4cbde64156b) exposes every user account to takeover without any credentials. The access control flaw (CWE-284) permits any network-reachable attacker to overwrite the password of any registered user, including administrators, enabling full account compromise. EPSS is low at 0.03% and CISA KEV lists no active exploitation, but SSVC flags the vulnerability as automatable with partial technical impact, and a public researcher disclosure on GitHub (wxhlcy/cve) suggests exploit steps are accessible.

Technical ContextAI

The affected system is a web-based Medical Management System tracked at Gitee (ljt12343/report) at a specific source commit rather than a versioned release, indicating an unpackaged or self-hosted deployment. The root cause is CWE-284 (Improper Access Control): the password-reset endpoint fails to enforce any ownership or authorization check, allowing a caller to supply an arbitrary target user identifier and set a new password. No authentication token, session, or email verification flow appears to be enforced before the reset is committed. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the endpoint is reachable over the network without credentials and requires no special conditions to trigger. CPE data from EUVD lists the affected version as 'n/a' indicating the vendor does not publish versioned releases, making patch tracking difficult.

RemediationAI

No vendor-released patch has been identified at time of analysis - the affected version field is listed as 'n/a' in both NVD and EUVD, and there is no advisory URL pointing to a fix commit or release. Operators should immediately restrict network access to the password-reset endpoint at the web server or firewall layer, permitting requests only from authenticated sessions or from trusted internal IP ranges. Disabling the self-service password-reset feature entirely and routing all resets through an authenticated administrator workflow eliminates the attack surface at the cost of user convenience. Additionally, audit all user accounts for unexpected password changes since deployment. Monitor the upstream Gitee repository (https://gitee.com/ljt12343/report) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-67437) for a patch commit. References: https://gitee.com/ljt12343/report/issues/IDB6P8, https://github.com/wxhlcy/cve/issues/2, https://vuldb.com/vuln/364194.