CVE-2025-62004 HIGH

CVE-2025-62004: BullWall Server Intrusion Protection (SIP) initialization race condition

Vendor Bullwall
Product Server Intrusion Protection
Weakness CWE-367
Published December 18, 2025
Last update January 15, 2026
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

BullWall Server Intrusion Protection (SIP) services are initialized after login services during system startup. A local, authenticated attacker can log in after boot and before SIP MFA is running. The SIP services do not retroactively enforce MFA or disconnect sessions that were not subject to SIP MFA. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions mayy also be affected. BullWall plans to improve detection method documentation.

Key dates

02Disclosure timeline

December 18, 2025 CVE published
January 15, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-45487 Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability CVE-2026-44112 OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes CVE-2025-69233 Apache CloudStack: Domain/account resources limits not honored CVE-2026-9796 Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability CVE-2026-44694 n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths