Auth bypass in Tinasoft Easycafe Server
CVE-2025-34119
A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers via TCP port 831. The server listens for a custom protocol where opcode 0x43 can be used to request arbitrary files by absolute path. If the file exists and is accessible, its content is returned without authentication. This flaw allows attackers to retrieve sensitive files such as system configuration, password files, or application data.
Vulnerability class: Broken Authentication
EPSS: 0.015 (72.0th percentile) — read the EPSS interpretation.
Affected products
- Tinasoft Easycafe Server — versions 2.2.14
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2025-34119?
- CVE-2025-34119 is a vulnerability in Tinasoft Easycafe Server, classified under Missing Authentication for Critical Function. Published 2025-07-16.
- Is CVE-2025-34119 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.