CVE-2025-6083 MEDIUM

CVE-2025-6083: ExtremeCloud Universal ZTNA Improper Authorization

Vendor Extreme Networks

Product ExtremeCloud Universal ZTNA

Weakness CWE-287 · Improper authentication

Published June 13, 2025

Last update June 17, 2025

View on NVD All CVEs

CVSS base score

5.2/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/S:N

What the vulnerability does

01Description

In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the owner_id filter. This issue may allow users to search data across the entire table instead of being restricted to their specific owner_id.

Key dates

02Disclosure timeline

June 13, 2025 CVE published

June 17, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-6083 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/287.html

Related vulnerabilities

04Related CVE

CVE-2018-0435 Cisco Umbrella API Unauthorized Access Vulnerability CVE-2022-35629 Velociraptor Client ID Spoofing CVE-2019-1662 Cisco Prime Collaboration Assurance Software Unauthenticated Access Vulnerability CVE-2022-39387 XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication CVE-2025-49831 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to IAM Authenticator Bypass via Mis-configured Network Device