What is CVE-2018-25129?

CVE-2018-25129 is a high-severity vulnerability in Soca Technology Co., Ltd Access Control System, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.5/10. Published 2025-12-24.

How severe is CVE-2018-25129?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Soca Technology Co., Ltd Access Control System

CVE-2018-25129

SOCA Access Control System 180612 contains multiple insecure direct object reference vulnerabilities that allow attackers to access sensitive user credentials. Attackers can retrieve authenticated and unauthenticated user password hashes and pins through unprotected endpoints like Get_Permissions_From_DB.php and Ac10_ReadSortCard.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.003 (24.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Soca Technology Co., Ltd Access Control System — versions 180612, 170000, 141007

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2018-25129?: CVE-2018-25129 is a high-severity vulnerability in Soca Technology Co., Ltd Access Control System, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.5/10. Published 2025-12-24.
How severe is CVE-2018-25129?: High severity. CVSS v3 base score is 7.5 out of 10.