CVE-2025-4557 CRITICAL

CVE-2025-4557: ZONG YU Parking Management System - Missing Authentication

Vendor Zong Yu

Product Parking Management System

Weakness CWE-306 · Missing auth

Published May 12, 2025

Last update May 12, 2025

View on NVD All CVEs

CVSS base score

9.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

The specific APIs of Parking Management System from ZONG YU has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific APIs and operate system functions. These functions include opening gates and restarting the system.

Key dates

02Disclosure timeline

May 12, 2025 CVE published

May 12, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-4557 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html

Related vulnerabilities

04Related CVE

CVE-2025-8025 Improper Access Control in Dinosoft Business Solutions' Dinosoft ERP CVE-2025-61945 Missing Authentication for Critical Function in Radiometrics VizAir CVE-2025-55108 BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution CVE-2026-0942 Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion CVE-2023-36926 Information disclosure vulnerability in SAP Host Agent