CVE-2025-56015: GenieACS Unauthenticated Access Vulnerability in NBI API Endpoint
Summary
CVE-2025-56015: GenieACS has an unauthenticated access vulnerability via the NBI API endpoint. Affects genieacs versions 1.2.13. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GenieACS is an open-source Auto Configuration Server (ACS) designed for managing and provisioning devices in a network. It provides a robust framework for handling device configurations, monitoring, and data collection. The software is widely used in telecommunications and IoT applications. However, version 1.2.13 has been identified to have a critical vulnerability that allows unauthenticated access to its NBI API endpoint, potentially exposing sensitive data and control over the devices managed by GenieACS.
Vulnerability Detail
In GenieACS version 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint. This flaw allows attackers to access sensitive information and perform unauthorized actions without needing any authentication. The vulnerability is classified under CWE-284, which pertains to improper access control. If exploited, this could lead to unauthorized data exposure and manipulation of device configurations, posing significant risks to network security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the NBI API endpoint by implementing network-level controls such as firewalls or VPNs to limit exposure to trusted IP addresses only. This will help mitigate the risk until the package is updated.
Conclusion
The unauthenticated access vulnerability in GenieACS version 1.2.13 poses significant risks to network security. It is crucial for users to update to the latest version to mitigate these risks and ensure the integrity of their device management systems. Implementing network-level controls can serve as a temporary measure until the update is applied.
See every vulnerability recorded for genieacs →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The vulnerability affects GenieACS version 1.2.13.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to unauthorized access to sensitive data and the ability to manipulate device configurations, posing significant risks to network security.
Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just package-lock.json. It helps developers stay informed about vulnerabilities affecting their applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for genieacs.
