Security readout for executives and security teams
Plain-English summary
CVE-2025-50850 is a reported weakness in CS Cart 4.18.3 vendor login controls. Without CAPTCHA, rate limiting, or blocking, attackers can repeatedly guess vendor credentials. Business risk is unauthorized vendor account access, possible data exposure, account misuse, and service impact from automated login traffic.
Executive priority
Prioritize assessment for public CS Cart vendor portals because the weakness affects account takeover resistance. Treat as high urgency until exposure and vendor remediation status are confirmed.
Technical view
The CVE describes missing brute-force protections on the vendor login endpoint in CS Cart 4.18.3. It is network-reachable, requires no prior authentication or user interaction, and has CVSS 8.6. Official affected-product metadata is incomplete, and no fixed version is named in the supplied sources.
Likely exposure
Exposure is most likely where CS Cart 4.18.3 vendor login is internet-accessible or reachable by untrusted users. The CVE metadata lists affected vendor/product as n/a, so confirm deployments directly.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. The described issue supports automated password guessing against vendor accounts, but the supplied evidence does not establish real-world exploitation.
Researcher notes
The strongest evidence is the CVE description and linked public report. Affected CPE data is absent, and no patch, workaround, or exploitation confirmation is provided in the supplied sources. Avoid assuming broader version impact.
Mitigation direction
- Check CS Cart vendor guidance for fixed versions or configuration changes.
- Add rate limiting and lockout controls to vendor login where supported.
- Enable CAPTCHA or equivalent bot challenge on vendor login.
- Require strong, unique passwords and MFA for vendor accounts.
- Monitor failed login spikes and unusual vendor account activity.
Validation and detection
- Inventory CS Cart deployments and identify any version 4.18.3 instances.
- Confirm whether vendor login is reachable from the internet.
- Review login configuration for CAPTCHA, rate limiting, and blocking controls.
- Check authentication logs for repeated failed vendor login attempts.
- Verify whether vendor advisories name a fixed version or workaround.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-804: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-50850 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H3.94.7CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/hackerwahab/CS-Cart-Vulns/blob/main/CVE-2025-50850.mdCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Guessable CAPTCHA
Guessable CAPTCHA represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.