What is the severity of CVE-2025-29996?

CVE-2025-29996 is classified as a critical vulnerability due to its potential for remote exploitation by attackers.

How do I fix CVE-2025-29996?

To fix CVE-2025-29996, ensure that the OTP verification mechanism in the CAP back office application is properly implemented and securely configured.

What systems are affected by CVE-2025-29996?

CVE-2025-29996 affects the CAP back office application that utilizes an API-based login mechanism.

Who can exploit CVE-2025-29996?

A remote attacker with valid credentials can exploit CVE-2025-29996 by manipulating the API request URL or payload.

What are the potential impacts of CVE-2025-29996?

Successful exploitation of CVE-2025-29996 could allow attackers to bypass authentication and gain unauthorized access to the application.

Vulnerability/
CVE-2025-29996

high

8.2

CWE

288

EPSS

0.077%

13/3/2025

CVE-2025-29996: Authentication Bypass Vulnerability in CAP back office application

First published: Thu Mar 13 2025(Updated: )

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.

Credit: vdisclose@cert-in.org.in

Affected Software	Affected Version	How to fix
CAP back office application

Remedy

Upgrade Rising Technosoft CAP back office application to the version 2.0.4 or later.

Never miss a vulnerability like this again

Reference Links

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0048

Frequently Asked Questions

What is the severity of CVE-2025-29996?
CVE-2025-29996 is classified as a critical vulnerability due to its potential for remote exploitation by attackers.
How do I fix CVE-2025-29996?
To fix CVE-2025-29996, ensure that the OTP verification mechanism in the CAP back office application is properly implemented and securely configured.
What systems are affected by CVE-2025-29996?
CVE-2025-29996 affects the CAP back office application that utilizes an API-based login mechanism.
Who can exploit CVE-2025-29996?
A remote attacker with valid credentials can exploit CVE-2025-29996 by manipulating the API request URL or payload.
What are the potential impacts of CVE-2025-29996?
Successful exploitation of CVE-2025-29996 could allow attackers to bypass authentication and gain unauthorized access to the application.

collector/mitre-cve
source/MITRE
agent/weakness
agent/remedy
agent/title
agent/references
agent/type
agent/description
agent/first-publish-date
collector/nvd-api
source/NVD
agent/last-modified-date
agent/author
agent/severity
agent/event
agent/guess-ai
agent/software-canonical-lookup
agent/software-canonical-lookup-request
agent/softwarecombine
collector/epss-latest
source/FIRST
agent/source
agent/tags
agent/epss
vendor/cap
canonical/cap back office application

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.