Back to Database
Status published
Critical
CVE-2025-2407
Missing Authentication & Authorization in Web-API allows adversary unrestricted access
Vulnerability Description
Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability is fixed in Version 1.5.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2407
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Manuel Walder
More from Mobatime
View All →CVE-2023-3066
Mobatime mobile application - Broken authorisation
High
8.1
CVE-2023-3065
Mobatime mobile application - Authentication bypass
Critical
9.1
CVE-2023-3064
Mobatime mobile application - Sensitive information disclosure
High
7.5
CVE-2023-3033
Mobatime web application - broken authorisation mechanisms
Medium
6.8
CVE-2023-3032
Mobatime web application - Arbitrary file upload (RCE)
High
8.1
Affected Vendor
Mobatime
View all reports →Affected Software
AMX MTAPI, AMXGT-100
Vulnerable Versions:
0
Timeline
Official Publish:
May 27th, 2025
Last Modified:
May 27th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
MITRE ATT&CK TTPs
T1190
Exploit Public-Facing Application
Initial Access
T1078
Valid Accounts
Persistence
T1136
Create Account
Persistence
T1098
Account Manipulation
Privilege Escalation
T1021
Remote Services
Lateral Movement
T1068
Exploitation for Privilege Escalation
Privilege Escalation
T1531
Account Access Removal
Impact