TI-2025-02031 Aliases CVE-2025-2311 GHSA-cfc5-c899-6ww2

Authentication Bypass in Sechard Information Technologies' SecHard

MEDIUM 40CWE-319Published 2025-03-20 · Updated 2026-06-06

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harvesting Information via API Event Monitoring. This issue affects SecHard: before 3.3.0.20220411.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00172 6th percentileScored 2026-11-07

Fix Fixed SecHard (Sechard Information Technologies): 3.3.0.20220411

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SecHard Information Technologies	SecHard	before 3.3.0.20220411	3.3.0.20220411	Patch available	CNA

SecHard VendorSecHard Information Technologies Affected before 3.3.0.20220411 Fixed in 3.3.0.20220411 Patch available CNA

Remediation

Fix · CNA SecHard (Sechard Information Technologies) Fixed in 3.3.0.20220411

Timeline

2026-10-02 Threatist record created from CVE-2025-2311
2026-10-03 Alias added: GHSA-cfc5-c899-6ww2

References

Other 2

TI-2025-07746 IDOR in SecHard Information Technologies' SecHard CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences