What’s Vulnerable › Vulnerabilities

CVE-2025-12870: aEnrich｜eHRD - Authentication Abuse

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-12 · updated 2026-10-18
• Weakness: CWE-1390

Description

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges.

Affected products

• aEnrich a+HRD: through 7.5

References

• https://www.twcert.org.tw/en/cp-139-10487-12a32-2.html
• https://www.twcert.org.tw/tw/cp-132-10486-a3459-1.html
• https://www.chtsecurity.com/news/b97e8337-6b0c-43e8-8e8c-187b7c0e13c2

Get alerted when CVE-2025-12870 or the next vulnerability affects your stack