CVE-2025-59090
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedOn the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled chip cards.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe exos 9300 server exposes an unauthenticated SOAP API on port 8002. Anyone with network access can send requests without credentials, enabling creation of arbitrary access log entries and extraction of 2FA PINs associated with enrolled chip cards.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- Authentication
- X
- User interaction
- None
- Scope
- X
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Verify port 8002 is open and listeningRun 'netstat -an | grep 8002' or 'nmap -p 8002 <target>' to determine if port 8002 is exposed on the systemAffected if Port 8002 is found to be listening or accessible from the network
-
Identify the service on port 8002Connect to port 8002 using curl or telnet and examine the HTTP response headers and banner, or run 'nmap -sV -p 8002 <target>' to identify the serviceAffected if The service is identified as the Exos 9300 SOAP API or related HTTP service
-
Test SOAP API authentication requirementSend a crafted SOAP request to port 8002 without any credentials (e.g., curl -X POST http://<target>:8002/) and observe if a valid response is returned without authentication headersAffected if The API returns a valid response without requiring any authentication token, session, or credentials
-
Check for 2FA PIN retrieval capabilitySend a SOAP request attempting to query 2FA/PIN enrollment data to the endpoint and verify if sensitive authentication data is returned without authorizationAffected if The API returns 2FA PINs or chip card enrollment information without proper authorization
-
Verify audit log manipulation is possibleSend a SOAP request to create an access log entry with arbitrary data and confirm the log is created without authenticationAffected if The API allows creation of arbitrary access log events without credentials, compromising audit integrity
The environment is affected if an Exos 9300 server has port 8002 open with an unauthenticated SOAP API that allows access to 2FA PINs or log manipulation without credentials.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataRestrict network access to port 8002 via firewall or ACLs to trusted sources only, or enable authentication on the SOAP API if supported by the vendor.
- Consultation3.0 h
- Implementation4.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,880.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-59090 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-59090 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data