Critical Vulnerability in Primakon Pi Portal: CVE-2025-64062 Allows Privilege Escalation

Overview

CVE-2025-64062 is a critical vulnerability discovered in Primakon Pi Portal version 1.0.18. This vulnerability allows an attacker to escalate privileges and gain full access to other user accounts, including the administrator, due to improper server-side validation in the /api/V2/pp_users?email endpoint.

Technical Details

The /api/V2/pp_users?email endpoint is intended to filter user data based on the provided email address. However, the application lacks sufficient server-side validation to verify that the authenticated session corresponds to the user whose data is being requested. By manipulating the email parameter, an attacker can effectively bypass authentication and impersonate other users. For example, setting the email parameter to otheruser@user.com allows an attacker to assume that user’s session and access their data and privileges. Even more critically, if the email parameter is left blank, the application defaults to returning the data of the first user in the system, which is typically the administrator. This leads to immediate and complete Privilege Escalation.

CVSS Analysis

Due to the critical nature of the vulnerability, a high CVSS score would be expected. However, the CVSS score is currently unavailable (N/A). Further analysis is required to calculate the accurate CVSS score, but based on the impact, it would likely be a CVSSv3 score of 9.0 or higher, indicating a critical severity.

Possible Impact

The impact of CVE-2025-64062 is severe. An attacker exploiting this vulnerability could:

• Gain complete control over user accounts, including administrator accounts.
• Access and modify sensitive user data.
• Compromise the entire Primakon Pi Portal system.
• Potentially gain access to other systems connected to the Pi Portal.

Mitigation or Patch Steps

The recommended mitigation steps include:

• Immediate Patching: Apply the latest patch released by Primakon to address this vulnerability. Contact Primakon support for the patch if it’s not readily available.
• Input Validation: Implement robust server-side validation to ensure that the authenticated session corresponds to the user whose data is being requested via the /api/V2/pp_users?email endpoint.
• Authentication Hardening: Review and strengthen the authentication mechanisms used by the Primakon Pi Portal.
• Access Control: Implement strict access control policies to limit user privileges based on the principle of least privilege.
• Web Application Firewall (WAF): Deploy a WAF to detect and block malicious requests targeting the vulnerable endpoint.