SiteServer SSCMS CVE-2026-124575

Exploitation requires reaching the SSCMS Admin-Login submit handler (LoginController.Submit) over the network and manipulating the isForceLogoutAndLogin argument to defeat the CAPTCHA / excessive-authentication-attempt restriction, after which an attacker can brute-force administrator credentials. No authentication is required (PR:N) and no user interaction is needed (UI:N), but exploitation is materially limited by the vendor-assessed high attack complexity (AC:H, 'difficult'): the condition that actually triggers the bypass is not described in the available sources beyond the isForceLogoutAndLogin parameter, and the attacker still needs the admin login interface to be network-reachable and must succeed at a subsequent credential-guessing step for meaningful impact.

This is a medium-severity issue (CVSS 4.0 base 6.3) that, on balance, is a lower real-world priority than the raw score suggests. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) shows a network-reachable, unauthenticated flaw, but the vendor explicitly rates attack complexity high (AC:H) and describes exploitability as 'difficult,' and the only impact is low confidentiality (VC:L) with no integrity or availability effect. The weakness (CWE-307, improper restriction of excessive authentication attempts) means a successful attacker degrades the admin-login CAPTCHA/rate-limiting protection, enabling credential brute force rather than achieving direct code execution or data theft. No EPSS score is provided, the CVE is NOT on CISA KEV, and no public exploit is identified, so there is no signal of active or imminent widespread exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-on-normal-cadence item. Note a data discrepancy: the description and source-line reference point to LoginController.Submit and the isForceLogoutAndLogin argument, but the supplied patch commit diff (df3becb7) shows password-storage changes in AdministratorRepository.cs (migrating from reversible DES/SM4 to PBKDF2), not a change to the CAPTCHA/rate-limiting logic - this mismatch should be verified against PR #3905 before treating the shown diff as the authoritative fix.

A remote, unauthenticated attacker repeatedly submits requests to the SSCMS admin login endpoint, manipulating the isForceLogoutAndLogin argument to evade the CAPTCHA/excessive-attempt restriction, and then runs an automated password-guessing campaign against administrator accounts. Because the vendor rates the attack as high-complexity and 'difficult,' reliable exploitation likely requires specific timing or request conditions rather than a trivial replay. No public exploit code is identified at time of analysis.