Skip to content
OpenAdvisories
Critical · 9.3 CVE-2025-2407 EUVD-2025-27715GHSA-qq3g-q238-5q86

Missing Authentication & Authorization in Web-API allows adversary unrestricted access

Published May 27, 2025 · Updated May 27, 2025 · Assigned by NCSC.ch

Description

Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability is fixed in Version 1.5.

Affected products

VendorProductAffectedFixed
Mobatime AMX MTAPI ≤ 6 —
Mobatime AMXGT-100 < 1.5 1.5

References