CVE-2025-54305: High severity Thermo Fisher Torrent Suite vulnerability
An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. One of the middlewares included in this application, LocalhostAuthMiddleware, authenticates users as ionadmin if the REMOTEADDR property in request.META is set to 127.0.0.1, to 127.0.1.1, or to ::1. Any user with local access to the server may bypass authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54305?
The severity of CVE-2025-54305 is high due to its impact on user authentication for the Thermo Fisher Torrent Suite.
How do I fix CVE-2025-54305?
To fix CVE-2025-54305, update the Thermo Fisher Torrent Suite to the patched version that addresses the LocalhostAuthMiddleware vulnerability.
What systems are affected by CVE-2025-54305?
CVE-2025-54305 affects the Thermo Fisher Torrent Suite Django application version 5.18.1.
What type of vulnerability is CVE-2025-54305?
CVE-2025-54305 is an authentication bypass vulnerability due to improper handling of the REMOTE_ADDR property.
Can unauthorized users gain access because of CVE-2025-54305?
Yes, unauthorized users can gain access as they can be authenticated as admin if their requests include local IP addresses.