Security readout for executives and security teams
Plain-English summary
CVE-2025-51054 describes a pre-authentication access-control flaw in Vedo Suite 2024.17. An unauthenticated remote attacker may obtain a high-privilege JWT by sending an empty POST request to the /autologin/ API endpoint. That could enable unauthorized access, but the source bundle does not confirm active exploitation or a vendor fix.
Executive priority
Prioritize assessment for any internet-facing Vedo Suite deployment. The CVSS rating is medium, but unauthenticated high-privilege token issuance can create meaningful business risk if the affected endpoint is exposed.
Technical view
The issue is classified as CWE-284 with CVSS 3.1 score 6.5. The vector is network-accessible, low complexity, no privileges, and no user interaction. Reported impact is limited confidentiality and integrity loss, no availability impact. The affected CPE/vendor metadata is incomplete in the CVE record.
Likely exposure
Organizations running Vedo Suite 2024.17 are the only clearly identified exposure group. Risk is higher where the application or /autologin/ endpoint is reachable from untrusted networks.
Exploitation context
The bundle references a public GitHub repository named vedo-suite-exploits, but KEV status is false and no cited source confirms active exploitation in the wild.
Researcher notes
The CVE record lacks normalized vendor, product, version, and CPE data beyond the description naming Vedo Suite 2024.17. Treat affected-product scoping and remediation status as incomplete until vendor guidance is available.
Mitigation direction
- Check Vedo Suite vendor guidance for patches or supported mitigations.
- Restrict external access to the /autologin/ endpoint where operationally possible.
- Review authentication gateway or WAF controls for unauthenticated access attempts.
- Rotate exposed sessions or JWT-related secrets if compromise is suspected.
- Increase logging and alerting around autologin and privileged token issuance.
Validation and detection
- Confirm whether Vedo Suite 2024.17 is deployed in your environment.
- Inventory whether /autologin/ is reachable from internet or partner networks.
- Review access logs for unauthenticated POST requests to /autologin/.
- Check for unexpected high-privilege JWT issuance or privileged account activity.
- Track CVE and vendor advisories for corrected affected-product metadata.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-51054 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N3.92.5CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/jacopoaugelli/vedo-suite-exploitsCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.