CVE-2025-4320

Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Authentication Bypass, Password Recovery Exploitation. This issue affects Sufirmam: through 23012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0005
https://www.usom.gov.tr/bildirim/tr-26-0005

Configurations

No configuration.

History

No history.

Information

Published : 2026-01-23 13:15

Updated : 2026-06-17 09:33

NVD link : CVE-2025-4320

Mitre link : CVE-2025-4320

CVE.ORG link : CVE-2025-4320

JSON object : View

Products Affected

No product.

CWE

CWE-305

Authentication Bypass by Primary Weakness

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2025-4320", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-4320", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-23T14:14:05.876045Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "iletisim@usom.gov.tr", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "iletisim@usom.gov.tr", "affectedData": [{"vendor": "Birebirsoft Software and Technology Solutions", "product": "Sufirmam", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "23012026"}], "defaultStatus": "unknown"}]}], "published": "2026-01-23T13:15:49.123", "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0005", "source": "iletisim@usom.gov.tr"}, {"url": "https://www.usom.gov.tr/bildirim/tr-26-0005", "source": "iletisim@usom.gov.tr"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "iletisim@usom.gov.tr", "description": [{"lang": "en", "value": "CWE-305"}, {"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Authentication Bypass, Password Recovery Exploitation.\n\nThis issue affects Sufirmam: through 23012026.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Omisi\u00f3n de autenticaci\u00f3n por debilidad primaria. Vulnerabilidad de mecanismo d\u00e9bil de recuperaci\u00f3n de contrase\u00f1a para contrase\u00f1a olvidada en Birebirsoft Software y Technology Solutions Sufirmam permite omitir la autenticaci\u00f3n, explotar la recuperaci\u00f3n de contrase\u00f1a. Este problema afecta a Sufirmam: hasta el 23012026. NOTA: Antes de la divulgar esta vulnerabilidad se contact\u00f3 con el proveedor, pero no respondi\u00f3 de ninguna manera."}], "lastModified": "2026-06-17T09:33:01.250", "sourceIdentifier": "iletisim@usom.gov.tr"}