CVE-2025-32377 - CVE House
Back to Database
Status published Medium CVE-2025-32377

Rasa Pro Missing Authentication For Voice Connector APIs

Vulnerability Description

Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source. This issue has been patched for audiocodes, audiocodes_stream, and genesys connectors in versions 3.9.20, 3.10.19, 3.11.7 and 3.12.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32377

Credits & Attribution

No credits recorded in the NVD database.

References

More from RasaHQ

View All →
CVE-2024-49375
Remote Code Execution via Remote Model Loading in Rasa
Critical 9.1
CVE-2021-41127
Maliciously Crafted Model Archive Can Lead To Arbitrary File Write in rasa
High 7.3

Affected Vendor

Affected Software

rasa-pro-security-advisories
Vulnerable Versions:
>= 3.12.0, < 3.12.6, >= 3.11.0, < 3.11.7, >= 3.10.0, < 3.10.19, < 3.9.20

Timeline

Official Publish: April 18th, 2025
Last Modified: April 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weaknesses (CWE)

CWE-306

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1136 Create Account
Persistence
T1098 Account Manipulation
Privilege Escalation
T1021 Remote Services
Lateral Movement