CVE-2025-2125: Control iD RH iD PDF Document companyId resource injection

Published Mar 9, 2025

Updated

A vulnerability has been found in Control iD RH iD 25.2.25.0 and classified as problematic. This vulnerability affects unknown code of the file /v2/report.svc/comprovantemarcacao/?companyId=1 of the component PDF Document Handler. The manipulation of the argument nsr leads to improper control of resource identifiers. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Control iD RH iD

Assaabloy Control Id Rhid=25.2.25.0

Event History

Mar 9, 2025

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-2125?

CVE-2025-2125 has been classified as problematic, indicating a notable risk level.

How do I fix CVE-2025-2125?

To mitigate CVE-2025-2125, it is recommended to update Control iD RH iD to the latest version that addresses this vulnerability.

What component is affected by CVE-2025-2125?

CVE-2025-2125 affects the PDF Document Handler component in Control iD RH iD.

What type of manipulation allows CVE-2025-2125 to be exploited?

CVE-2025-2125 can be exploited by manipulating the argument 'nsr' in the specified endpoint.

Which software is impacted by CVE-2025-2125?

CVE-2025-2125 impacts Control iD RH iD version 25.2.25.0.