CVE-2025-54548
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes).
Risk Assessment
Exposure of password hashes could allow attackers to crack them and take over accounts, posing a serious security threat.
Recommendation
Disable or restrict access to the debug API for unprivileged users. Apply security patches provided by the vendor.
Other vulnerabilities in Platform
See all- CVE-2025-25176Critical
Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform.
- CVE-2025-57213High
Incorrect access control in the orderService.queryObject component of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
- CVE-2025-57212High
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
- CVE-2025-57210High
Incorrect access control in the ApiPayController.java component of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors.
Original NVD description (English source)
On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS