CVE-2023-40725

Summary

CVE-2023-40725 is a newly discovered vulnerability affecting QMS Automotive software, versions below V12.39. The issue lies in the login session process where inconsistent error messages are returned in response to invalid user credentials. An attacker can exploit this vulnerability to enumerate usernames and potentially identify valid ones, increasing the risk of unauthorized access. This can pose a significant security threat to organizations using the affected software. It is recommended that users upgrade to the latest version, V12.39 or higher, to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.