CVE-2025-8861 CRITICAL

CVE-2025-8861: Changing｜TSA - Missing Authentication

Vendor Changing

Product TSA

Weakness CWE-306 · Missing auth

Published August 29, 2025

Last update August 29, 2025

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents.

Key dates

02Disclosure timeline

August 29, 2025 CVE published

August 29, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-8861 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html