CVE-2025-40718: Improper error handling vulnerability in Quiter Gateway

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-08 · updated 2026-06-17
Weakness: CWE-209

Description

Improper error handling vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to send malformed payloads to generate error messages containing sensitive information.

Affected products

Quiter Gateway (Java WAR on Apache Tomcat): before 4.7.0 — fixed in 4.7.0

How to fix

Upgrade to a fixed version: Quiter Gateway (Java WAR on Apache Tomcat) 4.7.0. Check the vendor advisory for mitigations.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter

Get alerted when CVE-2025-40718 or the next vulnerability affects your stack