What’s Vulnerable › Vulnerabilities

CVE-2025-10224: Incorrect Evaluation of LDAP Nested Groups during Login in AxxonSoft Axxon One (C-Werk)

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-10 · updated 2026-06-17
• Weakness: CWE-287

Description

Improper Authentication (CWE-287) in the LDAP authentication engine in AxxonSoft Axxon One (C-Werk) 2.0.2 and earlier on Windows allows a remote authenticated user to be denied access or misassigned roles via incorrect evaluation of nested LDAP group memberships during login.

Affected products

• AxxonSoft AxxonOne C-Werk: through 2.0.2

References

• https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories

Get alerted when CVE-2025-10224 or the next vulnerability affects your stack