CVE-2025-10223
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Insufficient Session Expiration in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows an authenticated attacker to retain access with removed privileges via continued use of an unexpired session token until natural expiration.
Risk Assessment
A user whose privileges have been revoked may still access the system, posing a threat to data confidentiality and integrity and potentially leading to unauthorized actions.
Recommendation
Update Axxon One to version 2.0.3 or later. Additionally, implement mechanisms to immediately invalidate sessions upon privilege changes.
Other vulnerabilities in Axxon One
See all- CVE-2026-121022High
Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 allows a remote unauthenticated attacker to log in as the built-in administrator with default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.
- CVE-2026-121021Medium
Plaintext storage of a password (CWE-256) in the SecurityManager shared configuration of AxxonSoft Axxon One before 3.1.0 allows a local attacker with read access to the configuration directory or backups to obtain the LDAP service account password from the main.conf file.
- CVE-2026-121020Medium
Exposure of sensitive information to an unauthorized actor (CWE-200) in the security configuration API of AxxonSoft Axxon One before 3.2.0 allows a remote authenticated low-privileged user to enumerate all configured users and roles, because the user configuration request returned complete lists regardless of the caller's permissions.
Original NVD description (English source)
Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticated attacker to retain access with removed privileges via continued use of an unexpired session token until natural expiration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS