CVE-2025-46018

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-01 · updated 2026-06-17
Weakness: CWE-290

Description

CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specific point during a transaction. This could result in unauthorized use of laundry services and potential financial loss.

Affected products

Cscsw Pay Mobile: 2.19.4

References

https://github.com/niranjangaire1995/CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass
https://www.cscsw.com/disclosure-process/

Get alerted when CVE-2025-46018 or the next vulnerability affects your stack