CVE-2025-12870 CRITICAL

CVE-2025-12870: aEnrich｜eHRD - Authentication Abuse

Vendor Aenrich
Product a+HRD
Weakness CWE-1390
Published November 12, 2025
Last update November 12, 2025
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges.

Key dates

02Disclosure timeline

November 12, 2025 CVE published
November 12, 2025 Record updated