What’s Vulnerable › Vulnerabilities

CVE-2025-34140: ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-22 · updated 2026-06-17
• Weakness: CWE-639

Description

An authorization bypass vulnerability exists in ETQ Reliance (legacy CG and NXG SaaS platforms). By appending a specific URI suffix to certain API endpoints, an unauthenticated attacker can bypass access control checks and retrieve limited sensitive resources. The root cause was a misconfiguration in API authorization logic, which has since been corrected in SE.2025.1 and 2025.1.2.

Affected products

• ETQ Reliance CG (legacy): before SE.2025.1 — fixed in SE.2025.1
• ETQ Reliance NXG (SaaS): before 2025.1.2 — fixed in 2025.1.2

How to fix

Upgrade to a fixed version: ETQ Reliance CG (legacy) SE.2025.1; ETQ Reliance NXG (SaaS) 2025.1.2. Check the vendor advisory for mitigations.

References

• https://www.etq.com/blog/etq-reliance-security-update/
• https://www.etq.com/product-overview/
• https://www.vulncheck.com/advisories/etq-reliance-cg-nxg-api-authorization-bypass-via-localized-text-uri-suffix

Get alerted when CVE-2025-34140 or the next vulnerability affects your stack