CVE-2025-10223: Improper Session Cleanup on Role Removal in Web Admin Panel in AxxonSoft Axxon One (C-Werk)
Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticated attacker to retain access with removed privileges via continued use of an unexpired session token until natural expiration.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10223?
CVE-2025-10223 has a high severity rating due to its potential for an attacker to maintain unauthorized access through unexpired session tokens.
How can I fix CVE-2025-10223?
To fix CVE-2025-10223, upgrade AxxonSoft Axxon One to version 2.0.3 or later where the vulnerability is patched.
What type of vulnerability is CVE-2025-10223?
CVE-2025-10223 is classified as an Insufficient Session Expiration vulnerability, where session tokens do not expire as expected.
Who is affected by CVE-2025-10223?
CVE-2025-10223 affects users of AxxonSoft Axxon One versions prior to 2.0.3 on Windows.
Can CVE-2025-10223 be exploited remotely?
Yes, CVE-2025-10223 can be exploited by a remote authenticated attacker who can leverage the unexpired session token.