CVE-2025-4560

Netvision ISOinsight - Missing Authentication

Medium6.9EPSS 0.35%

Published: 12 May 2025
Updated: 12 May 2025
Reserved: 12 May 2025
Assigned by: twcert

Description

The ISOinsight from Netvision has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access certain system functions. These functions include viewing the administrator list, viewing and editing IP settings, and uploading files.

Scores

CVSS scores of CVE-2025-4560, by who scored it
Scored by	CVSS	Score	Vector
twcertCNA (assigner)	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
twcertCNA (assigner)	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVDNVD · Deferred	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.35% · top 71% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

CWE-306 Missing Authentication for Critical Function (opens in a new tab)All about CWE-306 and its CVEs

Affected products

Netvision · ISOinsight
- affected 2.9.0 – < 2.9.0.250501
- affected 3.0.0 – < 3.0.0.250501

What to do

Solution: For v2.9.0.x, please update to version 2.9.0.250501 or later For v3.0.0.x, please update to version 3.0.0.250501 or later

References (2)

https://www.twcert.org.tw/tw/cp-132-10118-80a8c-1.html (opens in a new tab)third-party-advisory
https://www.twcert.org.tw/en/cp-139-10119-d9976-2.html (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-4560](https://trackcve.app/badge/CVE-2025-4560.svg)](https://trackcve.app/cve/CVE-2025-4560)

Record last updated 12 May 2025, 14:37 UTC.