Mender Client CVE-2025-67903

The vulnerable code path is reached when the Mender Client 5.x (before 5.0.4) processes a JWT token over a network connection - no authentication, user interaction, or elevated privileges are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The client must be network-reachable and processing JWT-authenticated API requests. Exploitation is limited to confidentiality impact (C:L); integrity (I:N) and availability (A:N) are unaffected per CVSS, meaning the bypass does not appear to enable installation of malicious updates or service disruption in the assessed scope. Only Mender Client major version 5 prior to 5.0.4 is confirmed vulnerable; other major versions are not mentioned in available data.

The CVSS base score of 5.3 (Medium) is corroborated by the narrow impact: only low confidentiality compromise (C:L), with no integrity or availability impact (I:N/A:N), which is notable for a signature verification bypass in an update client - it suggests the vulnerability does not directly enable delivery of malicious firmware. The EPSS score of 0.02% at the 5th percentile strongly indicates no observed exploitation activity at the time of reporting. This is not listed in CISA's KEV catalog. The attack complexity is Low (AC:L) with no privileges (PR:N) required, meaning exploitation is straightforward for any network-accessible instance, but the constrained impact caps real-world severity. The discrepancy between the 'Authentication Bypass' tag and the I:N CVSS impact warrants caution - defenders should verify whether unauthorized read access to sensitive device state or configuration data is possible in their deployment. Overall, this is a genuine vulnerability requiring patching but not an emergency-priority item based on available signals.

An unauthenticated remote attacker sends a crafted JWT with a forged or unsigned payload to a Mender Client 5.x instance accessible over the network. Because the client does not properly verify the token's cryptographic signature (CWE-347), it accepts the token as valid, granting the attacker unauthorized read access to protected information exposed by the client. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity (AC:L) means any attacker familiar with JWT manipulation techniques could replicate this attack.