CVE-2025-54122

CRITICAL

Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability has been identified in the proxy handler component of both manager D...

Affects 0 products across 2 vendors.

BCS7.53
CVSS 3.110.0
EPSS0.8%
Percentile55th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-918: Server-Side Request Forgery (SSRF)

Attacker causes the server to make HTTP requests to attacker-chosen destinations, potentially reaching internal services.

Related Attack Patterns (CAPEC)
CAPEC-664 Server Side Request Forgery
via CWE-918

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability has been identified in the proxy handler component of Manager-io/Manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an unauthenticated attacker to bypass network isolation and access restrictions, potentially enabling access to internal systems and data.

BSID: BS-2025-GLOBAL-277826-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-54122?
A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability has been identified in the proxy handler component of Manager-io/Manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an unauthenticated attacker to bypass network isolation and access restrictions, potentially enabling access to internal systems and data.
What is the CVSS score for CVE-2025-54122?
CVE-2025-54122 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 0.8%.
Is CVE-2025-54122 actively exploited?
No confirmed active exploitation of CVE-2025-54122 as of 2026-05-30.
How do I remediate CVE-2025-54122?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-54122?
CVE-2025-54122 affects: Cloud, Full.
Vulnerability Details
CVE IDCVE-2025-54122
BSIDBS-2025-GLOBAL-277826-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2025-07-21
Last Modified2026-04-15
ICS Relevance15%
Weakness (CWE)
Server-Side Request Forgery (SSRF)
SourceNVD
Official Description

Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an unauthenticated attacker to bypass network isolation and access restrictions, potentially enabling access to internal services, cloud metadata endpoints, and exfiltration of sensitive data from isolated network segments. This vulnerability is fixed in version 25.7.21.2525.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability exists in the proxy handler component of Manager-io/Manager. An attacker can exploit this by sending a specially crafted request to the proxy handler, which can then be used to make requests to internal systems or other external systems as if they were coming from the server itself, bypassing network isolation and access restrictions.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Cloud — —
Full — —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: August 2026 | Threat Age: 378 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashe36f8d67f09be99604d1cd9cf72d6989133db0fa321620344b50bdb7b3edce2b20cec6dd176e3ebf04836cd1505ec86f5b7dc1e9a17b99a159f73ba6f5cd1b66
Related CVEs affecting Cloud
CVE-2025-41243 10.0 Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment p... CVE-2025-64180 10.0 Manager-io/Manager is accounting software. In Manager Desktop and Server vers... CVE-2026-0501 9.9 Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Prem... CVE-2025-47282 9.9 Gardener External DNS Management is an environment to manage external DNS ent... CVE-2024-45489 9.8 Arc before 2024-08-26 allows remote code execution in JavaScript boosts. Boos...
View all Cloud CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →