CVE-2025-11949: Digiwin｜EasyFlow .NET and EasyFlow AiNet - Missing Authentication

Published Oct 21, 2025

Updated

EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain database administrator credentials via a specific functionality.

Affected Software

2 affected components

Digiwin EasyFlow .NET

Digiwin EasyFlow AiNet

Remediation

Information

Update EasyFlow.NET to version 6.6.19 and install the patch 20250520 Update EasyFlow AiNet to version 8.1.1 and install the patch 20250520

Event History

Oct 21, 2025

CVE Published

via MITRE·06:49 AM

Data Sourced

via MITRE·06:49 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-11949?

CVE-2025-11949 is considered a high-severity vulnerability due to its potential for unauthenticated remote access to sensitive administrator credentials.

How do I fix CVE-2025-11949?

To fix CVE-2025-11949, ensure that proper authentication mechanisms are implemented for all sensitive functionalities in Digiwin EasyFlow .NET and EasyFlow AiNet.

What types of attacks are possible with CVE-2025-11949?

CVE-2025-11949 allows unauthenticated attackers to exploit the vulnerability and gain access to database administrator credentials.

Which versions of Digiwin software are affected by CVE-2025-11949?

Both Digiwin EasyFlow .NET and EasyFlow AiNet are affected by CVE-2025-11949 regardless of version.

What is the impact of exploiting CVE-2025-11949?

Exploiting CVE-2025-11949 can lead to unauthorized access to critical database systems and potential data breaches.