CVE-2025-10288: roncoo roncoo-pay list improper authentication
A vulnerability was found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. The impacted element is an unknown function of the file /user/info/list. Performing manipulation results in improper authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10288?
The severity of CVE-2025-10288 is classified as critical due to its potential for improper authentication.
How do I fix CVE-2025-10288?
To fix CVE-2025-10288, upgrade the roncoo-pay software to a version later than 9428382af21cd5568319eae7429b7e1d0332ff40.
What types of attacks are possible with CVE-2025-10288?
CVE-2025-10288 allows for remote attacks that exploit improper authentication mechanisms.
Which version of roncoo-pay is affected by CVE-2025-10288?
CVE-2025-10288 affects all versions of roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40.
Who is the vendor of CVE-2025-10288?
The vendor of CVE-2025-10288 is Roncoo, responsible for the roncoo-pay product.