VaelsysV4 CVE-2025-8261
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reflecting researcher's claimed unauthenticated network vector; C:L and I:L for limited information disclosure and user creation; A:N as no availability impact is described.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Vaelsys VaelsysV4 4.1.0. This vulnerability affects unknown code of the file /grid/vgrid_server.php of the component User Creation Handler. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The real existence of this vulnerability is still doubted at the moment. The vendor explains: "Based on Vaelsys' analysis, the reported behavior does not allow actions beyond those already permitted to authenticated administrative users, and no change in system configuration or operational practices is necessary."
AnalysisAI
Improper authorization in Vaelsys VaelsysV4 4.1.0 exposes the User Creation Handler at /grid/vgrid_server.php to potential unauthorized user creation via remote network requests. A publicly available proof-of-concept demonstrates the technique, though the vendor formally disputes the finding, asserting the endpoint enforces authenticated administrative context and no unauthorized escalation is possible. EPSS stands at 0.12% (30th percentile), no CISA KEV listing exists, and the real-world exploitability remains contested - making this a low-confidence finding that nonetheless warrants verification by affected operators.
Technical ContextAI
VaelsysV4 is a PHP-based video management or security operations platform (CPE: cpe:2.3:a:vaelsys:vaelsys:4.1.0). The vulnerable component is /grid/vgrid_server.php, the server-side handler for a grid/vgrid subsystem responsible for user creation. The root cause is classified as CWE-266 (Incorrect Privilege Assignment), meaning the application fails to correctly enforce privilege boundaries - either by not validating session roles before processing user creation requests, or by assigning overly broad permissions upon certain call paths. The PHP nature of the endpoint suggests server-side logic that may bypass role checks when certain parameters are supplied, consistent with the 'Information Disclosure' and 'PHP' tags that hint at session or role data leakage enabling the bypass.
RemediationAI
The vendor's position per advisory VSEC_V4_2025_07_0003 is that no change in system configuration or operational practices is necessary, and no patch has been released. No vendor-released patch is identified at time of analysis. Operators who cannot independently confirm the vendor's dispute should consider applying compensating controls: restrict network access to /grid/vgrid_server.php via web server access controls (e.g., IP allowlisting or require authentication at the reverse-proxy layer), review web server logs for anomalous POST requests to that endpoint, and audit the user list for unexpected accounts. These controls carry minimal operational side effects. Monitor the vendor advisory at https://vaelsys.github.io/security-advisory/advisories/VSEC_V4_2025_07_0003.html for any revision of the vendor's position.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today