Mcphub EUVD-2025-209433

CVSS 5.3 reflects a medium-severity issue with low confidentiality and integrity impact (VC:L/VI:L) but no availability impact. The attack vector is Adjacent Network (AV:A), meaning the attacker must be on the same network segment, which significantly constrains real-world exploitability compared to network-wide attacks. The CVSS vector shows no complexity (AC:L), no user interaction required (UI:N), and no special privileges needed (PR:N), making exploitation straightforward once network access is gained. However, the constraint to AV:A (internal networks, VPN, etc.) rather than AV:N (internet-wide) substantially reduces the threat surface for most organizations. The integrity impact allows attackers to modify data as other users, which could enable fraud, privilege escalation, or lateral movement within trusted network boundaries. This is a real but localized risk-primarily concerning for organizations where physical or VPN access is possible and where internal threat models account for compromised network nodes.

An attacker with access to the same network segment as a MCPHub instance (e.g., via VPN compromise, rogue wireless AP, or internal lateral movement) sends HTTP requests directly to unprotected endpoints, crafting the requests to include headers or identifiers that associate them with a legitimate user's session. Since the endpoints lack authentication middleware, the requests are processed as if they originated from that user, allowing the attacker to read sensitive data or modify records under the victim's identity without ever providing valid credentials.