Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2025-2395: U-Office Force: Unauthenticated Access to Administrator Account
CVE-2025-2395 · published 1 year ago
Summary
U-Office Force users are at risk of unauthorized administrator access. An attacker can exploit this vulnerability to gain full control over the system. Update to the latest version of U-Office Force to fix the issue.
What to do
- Update edetw u-office_force to version 28.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| edetw | u-office_force |
< 28.0 cpe:2.3:a:edetw:u-office_force:*:*:*:*:*:*:*:* |
Original advisory text
The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter cookies to log in as an administrator.
The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter cookies to log in as an administrator.
References
- https://www.twcert.org.tw/en/cp-139-10012-d5bbc-2.html Third Party Advisory
- https://www.twcert.org.tw/tw/cp-132-10011-3de72-1.html Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-565Reliance on Cookies without Validation and Integrity Checking
Timeline
Published17 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-2395 · NVD
Track software like this
Free during beta