CVE-2025-41086

Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions. The validator uses an insecure checksum algorithm; knowing this algorithm and the format of the license lines, an attacker can recalculate the checksum and generate a valid license to grant themselves full privileges without credentials or access to the source code, allowing them unrestricted access to GAMS's mathematical models and commercial solvers.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.gams.com/latest/docs/RN_51.html	Release Notes
https://www.incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-gams-gams-development-corp	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gams:gams::::::::
	cpe:2.3:a:gams:gams::::::::

History

18 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad en el sistema de control de acceso del sistema de licencias GAMS que permite generar licencias válidas ilimitadas, eludiendo cualquier restricción de uso. El validador utiliza un algoritmo de suma de verificación (checksum) inseguro; conociendo este algoritmo y el formato de las líneas de licencia, un atacante puede recalcular la suma de verificación (checksum) y generar una licencia válida para otorgarse privilegios completos sin credenciales o acceso al código fuente, permitiéndoles acceso sin restricciones a los modelos matemáticos y solucionadores comerciales de GAMS.

Information

Published : 2025-12-02 14:16

Updated : 2026-10-18 18:10

NVD link : CVE-2025-41086

Mitre link : CVE-2025-41086

CVE.ORG link : CVE-2025-41086

JSON object : View

Products Affected

gams

gams

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-41086", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41086", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-02T14:24:13.177532Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@incibe.es", "affectedData": [{"vendor": "AMS Development Corp.", "product": "GAMS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "49.6.0"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-02T14:16:25.070", "references": [{"url": "https://www.gams.com/latest/docs/RN_51.html", "tags": ["Release Notes"], "source": "cve-coordination@incibe.es"}, {"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-gams-gams-development-corp", "tags": ["Third Party Advisory"], "source": "cve-coordination@incibe.es"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions. The validator uses an insecure checksum algorithm; knowing this algorithm and the format of the license lines, an attacker can recalculate the checksum and generate a valid license to grant themselves full privileges without credentials or access to the source code, allowing them unrestricted access to GAMS's mathematical models and commercial solvers."}, {"lang": "es", "value": "Vulnerabilidad en el sistema de control de acceso del sistema de licencias GAMS que permite generar licencias v\u00e1lidas ilimitadas, eludiendo cualquier restricci\u00f3n de uso. El validador utiliza un algoritmo de suma de verificaci\u00f3n (checksum) inseguro; conociendo este algoritmo y el formato de las l\u00edneas de licencia, un atacante puede recalcular la suma de verificaci\u00f3n (checksum) y generar una licencia v\u00e1lida para otorgarse privilegios completos sin credenciales o acceso al c\u00f3digo fuente, permiti\u00e9ndoles acceso sin restricciones a los modelos matem\u00e1ticos y solucionadores comerciales de GAMS."}], "lastModified": "2026-10-18T18:10:00.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gams:gams:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "164E9A9E-5416-4A53-A5B9-2E79E36A1A06", "versionEndExcluding": "48.7.0"}, {"criteria": "cpe:2.3:a:gams:gams:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4E916DD-7173-4A20-BC18-CA056EA771A2", "versionEndExcluding": "49.7.0", "versionStartIncluding": "49.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@incibe.es"}