Skip to content
OpenAdvisories
Critical ICSA-25-175-07 3 CVEs

MICROSENS NMP Web+

Published Jun 24, 2025 · Updated Jun 24, 2025

Vendor: Microsens Product: NMP Web+

Summary

Successful exploitation of these vulnerabilities could allow an attacker to gain system access, overwrite files or execute arbitrary code.

Vulnerabilities 3

  • Critical 9.3
    CVE-2025-49151

    Use of Hard-coded, Security-relevant Constants in MICROSENS NMP Web+

    The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens (JWT) to bypass authentication.

    Microsens NMP Web+
  • Critical 9.3
    CVE-2025-49153

    Path Traversal in MICROSENS NMP Web+

    The affected products could allow an unauthenticated attacker to overwrite files and execute arbitrary code.

    Microsens NMP Web+
  • High 8.7
    CVE-2025-49152

    Insufficient Session Expiration in MICROSENS NMP Web+

    The affected products contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to the system.

    Microsens NMP Web+

Revision history

  1. #1

    Initial Publication

References