EUVD-2025-208629Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 6.9 with AV:A/AC:L positioning suggests moderate-to-high severity, but must be contextualized within real-world constraints. The attack vector of 'Adjacent' (AV:A) significantly reduces exposure compared to network-wide or internet-facing attacks—only devices on the same local network can attack. The requirement for user interaction (UI:P) further limits automated exploitation. The high confidentiality impact (VC:H) is concerning and indicates sensitive data exposure is possible. Without confirmed KEV status, EPSS score, or public proof-of-concept details, this appears to be a legitimate local-network-based data leakage threat rather than a critical internet-facing vulnerability. Organizations should prioritize this based on local network segmentation and trust model: highly concerning in open corporate networks or shared office environments, less critical in segmented or air-gapped deployments. |
| Exploit ScenarioDerived | An attacker on the same local network (e.g., shared office WiFi, guest network segment, or compromised IoT device) sends specially crafted requests to the EasyShare module to bypass authentication checks. If a legitimate user is actively using the EasyShare feature (satisfying the UI:P requirement), the attacker can intercept or directly access sensitive data exposed through the unauthenticated feature. No public proof-of-concept has been confirmed, but the low attack complexity (AC:L) indicates the exploit technique is likely straightforward once the specific vulnerable feature is identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
The EasyShare module contains an authentication bypass vulnerability in a specific feature that allows data leakage when certain conditions are met on a local network. The vulnerability affects users of products implementing the EasyShare module and requires user interaction to exploit, but can result in high-impact confidentiality breach. While the CVSS score of 6.9 indicates medium-high severity, the attack vector is limited to adjacent networks (AV:A) and requires user participation (UI:P), suggesting real-world exploitation may be less prevalent than the numeric score implies.
RemediationAI
Contact your software vendor for the security advisory and patch release for EasyShare module or products containing this module, then upgrade to the patched version immediately. Until patches are available, implement the following mitigations: restrict EasyShare feature access to trusted local network segments using network access control lists or VLAN segmentation, disable the vulnerable EasyShare feature if not essential to operations, require multi-factor authentication for any accounts that can access EasyShare functionality, and monitor local network traffic for suspicious authentication attempts to the EasyShare service. Review and strengthen local network trust assumptions, particularly in shared or open network environments where untrusted devices may be present.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-306 (Missing Authentication Check), indicating that the EasyShare module fails to properly verify user identity or authorization before granting access to a specific feature on local networks. The CVSS:4.0 vector shows the attack requires network adjacency (AV:A), meaning an attacker must be on the same local network segment. The weakness allows an unauthenticated or inadequately authenticated principal to access protected resources, likely due to improper session management, token validation, or credential verification mechanisms within the EasyShare feature set. This type of flaw is particularly dangerous in network-adjacent scenarios where broadcast or multicast discovery mechanisms might expose the vulnerable service to all devices on the local subnet.
Know when Easyshare gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The authentication mechanism for a specific feature in the EasyShare module contains a vulnerability. If specific conditions are met on a local network, it can cause data leakage
Executive ViewAI
Organizations using authentication mechanism for a specific feature in the EasyShare module should be aware of notable risk from CVE-2025-15515, a missing authentication vulnerability rated CVSS 6.9. This could allow unauthorized access to protected resources. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access, enable MFA, monitor auth logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB