CVE-2025-65185

There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and new password then reviewing application responses.

CVSS v3 2.8 LOW

2.8^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.3 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://entrinsik.com	Product
https://www.triaxiomsecurity.com/entrinsik-informer-username-enumeration-cve-2025-65185/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:entrinsik:informer:5.10.1:*:*:*:*:*:*:*

History

13 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Hay una enumeración de nombres de usuario a través del inicio de sesión de usuario local en Entrinsik Informer v5.10.1, lo que permite a usuarios maliciosos enumerar usuarios al introducir un código OTP y una nueva contraseña y luego revisar las respuestas de la aplicación.

Information

Published : 2025-12-17 17:15

Updated : 2026-10-13 11:10

NVD link : CVE-2025-65185

Mitre link : CVE-2025-65185

CVE.ORG link : CVE-2025-65185

JSON object : View

Products Affected

entrinsik

informer

CWE

CWE-203

Observable Discrepancy

{"id": "CVE-2025-65185", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65185", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-17T18:56:41.418404Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.8, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.3}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-17T17:15:50.537", "references": [{"url": "https://entrinsik.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.triaxiomsecurity.com/entrinsik-informer-username-enumeration-cve-2025-65185/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and new password then reviewing application responses."}, {"lang": "es", "value": "Hay una enumeraci\u00f3n de nombres de usuario a trav\u00e9s del inicio de sesi\u00f3n de usuario local en Entrinsik Informer v5.10.1, lo que permite a usuarios maliciosos enumerar usuarios al introducir un c\u00f3digo OTP y una nueva contrase\u00f1a y luego revisar las respuestas de la aplicaci\u00f3n."}], "lastModified": "2026-10-13T11:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:entrinsik:informer:5.10.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FE8E031-6663-4EE1-82EA-6B91C9A278AF"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}