CVE-2025-15016: Ragic｜Enterprise Cloud Database - Hard-coded Cryptographic Key

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-22 · updated 2026-10-14
Weakness: CWE-321

Description

Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information and log into the system as any user.

Affected products

Ragic Enterprise Cloud Database: all versions

References

https://www.twcert.org.tw/en/cp-139-10588-771e5-2.html
https://www.twcert.org.tw/tw/cp-132-10587-797c6-1.html

Get alerted when CVE-2025-15016 or the next vulnerability affects your stack