CVE-2025-12871

critical · 9.3

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.

9.3

CVSS

0.6%

EPSS (exploit prob.)

46th

EPSS percentile

2025-11-12

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-1390

Affected products

Vendor	Product	Affected versions
aenrich	a+hrd	<= 7.5

Check a specific version with /api/v1/cve/match.

References

https://www.twcert.org.tw/en/cp-139-10487-12a32-2.html
https://www.twcert.org.tw/tw/cp-132-10486-a3459-1.html
https://www.chtsecurity.com/news/b97e8337-6b0c-43e8-8e8c-187b7c0e13c2

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-12871