CVE-2025-64067: Critical Data Exposure Found in Primakon Pi Portal 1.0.18

Overview

CVE-2025-64067 details a significant data exposure vulnerability within the Primakon Pi Portal version 1.0.18. Specifically, the API endpoints responsible for retrieving object-specific data (like user profiles and project records) lack sufficient server-side validation to confirm the requesting user’s authorization to access the requested data. This can lead to unauthorized access to sensitive personal and organizational information.

Technical Details

The vulnerability can be exploited in two primary ways:

• Direct ID Manipulation (IDOR): By manipulating the ID parameter (e.g., user_id, project_id) in API requests, an attacker can potentially access objects and data belonging to other users. For example, changing user_id from 123 to 456 might grant access to user 456’s profile.
• Filter Omission: By omitting filtering parameters in API requests, an attacker can cause the endpoint to return an unfiltered dataset containing all stored records for all users. This bypasses intended access restrictions and exposes a large amount of sensitive data.

The core issue lies in the lack of robust server-side checks to verify that the user making the request is authorized to view the specific data being requested. The application relies on client-side or easily bypassed mechanisms, rather than enforcing access controls on the server.

CVSS Analysis

Due to the absence of provided CVSS score and Severity, a formal assessment is unavailable. However, given the potential for unauthorized access to sensitive personal and organizational information, this vulnerability is likely to receive a High severity rating with a CVSS score between 7.0 and 8.9 upon formal analysis. A high impact to Confidentiality is almost guaranteed.

Possible Impact

The exploitation of CVE-2025-64067 could have severe consequences, including:

• Data Breach: Unauthorized access to user profiles, project records, and other sensitive data.
• Compliance Violations: Potential violation of data privacy regulations (e.g., GDPR, CCPA) due to unauthorized disclosure of personal information.
• Reputational Damage: Loss of customer trust and damage to the organization’s reputation.
• Financial Loss: Costs associated with incident response, legal fees, and potential fines.

Mitigation and Patch Steps

To mitigate the risk posed by CVE-2025-64067, the following steps should be taken:

1. Apply the Patch: Immediately apply the latest security patch provided by Primakon. Contact Primakon support for patch availability and instructions.
2. Implement Server-Side Authorization Checks: Implement robust server-side validation to ensure that the requesting user is authorized to access the requested object or dataset. This should include checking user roles, permissions, and ownership.
3. Input Validation: Sanitize and validate all user inputs to prevent manipulation of ID parameters. Use parameterized queries or prepared statements to prevent SQL injection vulnerabilities.
4. Implement Access Control Lists (ACLs): Enforce granular access control lists to restrict access to sensitive data based on user roles and permissions.
5. Regular Security Audits: Conduct regular security audits and penetration testing to identify and address potential vulnerabilities.
6. Web Application Firewall (WAF): Consider implementing a WAF to detect and block malicious requests attempting to exploit the vulnerability.

References

GitHub – Vulnerability Details
Primakon Pi Portal Information