CVE-2025-68392: Incorrect authorization in Protectel

Published Oct 30, 2026

Updated

ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ARKETEAM Protectel PROTECTELMAJ to a version that resolves this vulnerability.
Fixed in 6.5.19
Upgrade
Upgrade ARKETEAM Protectel BDF to a version that resolves this vulnerability.
Fixed in 6.4.67

Event History

Oct 30, 2026

CVE Published

via MITRE·11:37 AM

Data Sourced

via MITRE·11:37 AM

DescriptionWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs a low-privileged user account. They can then forge direct requests to a specific endpoint to access some functionality reserved for administrators.

Which releases contain the fix?

The issue is fixed in PROTECTELMAJ v6.5.19 and BDF v6.4.67.

How can I determine whether my deployment needs attention?

Identify whether you use the PROTECTELMAJ or BDF modules and check their installed versions. Deployments not running the stated fixed releases should be reviewed and updated.

CVE-2025-68392: Incorrect authorization in Protectel

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which releases contain the fix?

How can I determine whether my deployment needs attention?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which releases contain the fix?

How can I determine whether my deployment needs attention?