What’s Vulnerable › Vulnerabilities

CVE-2025-30236

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-19 · updated 2026-06-17
• Weakness: CWE-472

Description

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) if an HTTP POST request contains a SESSION parameter.

Affected products

• SecurEnvoy SecurAccess: before 9.4.515 — fixed in 9.4.515

How to fix

Upgrade to a fixed version: SecurEnvoy SecurAccess 9.4.515. Check the vendor advisory for mitigations.

References

• https://reserge.org/probabilistically-breaking-securenvoy-totp/
• https://securenvoy.com/wp-content/uploads/2025/03/Release-Notes-9.4.515.pdf

Get alerted when CVE-2025-30236 or the next vulnerability affects your stack