CVE-2025-4558

CRITICAL

The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the modified password to log into the system.

Affects 0 products across 1 vendor.

BCS7.27
CVSS 3.19.8
CVSS v49.3
EPSS0.5%
Percentile41th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-620: CWE-620
◆ SAGE Intelligence — CITED Relevance Research Team

The GPM from WormHole Tech is vulnerable to an Unverified Password Change vulnerability, enabling unauthenticated remote attackers to change any user's password and gain unauthorized access to the system.

BSID: BS-2025-GLOBAL-264384-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-4558?
The GPM from WormHole Tech is vulnerable to an Unverified Password Change vulnerability, enabling unauthenticated remote attackers to change any user's password and gain unauthorized access to the system.
What is the CVSS score for CVE-2025-4558?
CVE-2025-4558 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.5%.
Is CVE-2025-4558 actively exploited?
No confirmed active exploitation of CVE-2025-4558 as of 2026-05-30.
How do I remediate CVE-2025-4558?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-4558?
CVE-2025-4558 affects: Modified.
Vulnerability Details
CVE IDCVE-2025-4558
BSIDBS-2025-GLOBAL-264384-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2025-05-12
Last Modified2026-04-15
ICS Relevance0%
Weakness (CWE)
CWE-620
SourceNVD
Official Description

The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the modified password to log into the system.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by sending a specially crafted request to the GPM server to change a user's password without requiring any authentication or verification. This allows the attacker to log in as any user with the newly set password.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Modified — —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: September 2026 | Threat Age: 480 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash4d2875d42e63fb32a06c197efe9b045a94b71553f687148fb21ab41163738a5b0c684821f9463cd2beaae00a4b09e121787312738cb9250033df7f4ff632b721
Related CVEs affecting Modified
CVE-1999-0663 10.0 A system-critical program, library, or file has a checksum or other integrity... CVE-2025-5310 9.8 Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented a... CVE-2016-3694 9.8 Multiple SQL injection vulnerabilities in modified eCommerce Shopsoftware 2.0... CVE-2026-42298 9.8 Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn... CVE-2026-22903 9.8 An unauthenticated remote attacker can send a crafted HTTP request containing...
View all Modified CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →