What is the CVSS score of CVE-2025-8025?

CVE-2025-8025 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dinosoft Business Solutions Dinosoft ERP are affected by CVE-2025-8025?

A critical authentication bypass vulnerability in Dinosoft ERP (CVE-2025-8025, CVSS 9.8) allows unauthorized users to access restricted functionality without proper authorization controls.

How to fix or mitigate CVE-2025-8025?

Within 24 hours: Inventory all Dinosoft ERP instances and confirm affected versions; isolate or restrict network access to ERP systems if possible; enable enhanced logging and monitoring for unauthorized access attempts. Within 7 days: Implement network segmentation to limit ERP access to authorized personnel only; review access logs for suspicious activity; contact Dinosoft for patch availability timeline and interim guidance. Within 30 days: Apply vendor patch immediately upon availability; conduct full access control audit; review and enforce role-based access control (RBAC) policies.

Dinosoft Business Solutions Dinosoft ERP CVE-2025-8025

CRITICAL

Improper Access Control (CWE-284)

2026-02-11 iletisim@usom.gov.tr

Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 13:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dinosoft ERP: from < 3.0.1 through 11022026.

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.