CVE-2025-4687: Account pre-hijacking through invite misuse
In Teltonika Networks Remote Management System (RMS), it is possible to perform account pre-hijacking by misusing the invite functionality. If a victim has a pending invite and registers to the platform directly, they are added to the attackers company without their knowledge. The victims account and their company can then be managed by the attacker.This issue affects RMS: before 5.7.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4687?
CVE-2025-4687 has a high severity rating due to the potential for account pre-hijacking.
How do I fix CVE-2025-4687?
To fix CVE-2025-4687, ensure that users are aware of pending invites and implement additional verification steps during account registration.
What versions of Teltonika Networks Remote Management System are affected by CVE-2025-4687?
CVE-2025-4687 affects versions up to 5.7 of the Teltonika Networks Remote Management System.
How does the account pre-hijacking vulnerability in CVE-2025-4687 work?
The vulnerability in CVE-2025-4687 allows an attacker to add a victim to their company by exploiting the invite functionality when the victim registers directly.
What are the risks associated with CVE-2025-4687?
The risks associated with CVE-2025-4687 include unauthorized access to sensitive information and control over the victim's account.