VulnerabilityAnalyzed

CVE-2025-13480

Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints.

MEDIUM 5.1EPSS 0.26%

Does this matter?

Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.

Description

Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings. This vulnerability has been fixed in version 5.6.3

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.26% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-863
Affected: fudosecurity/fudo enterprise
Source: cvd@cert.pl

References

https://cert.pl/en/posts/2026/04/CVE-2025-13480Third Party Advisory
https://download.fudosecurity.com/documentation/fudo/5_6/rn/RN_5.6.3.pdfRelease Notes
https://www.fudosecurity.com/product/enterpriseProduct

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.