CVE-2025-40668 - CVE House
Back to Database
Status published High CVE-2025-40668

Incorrect Authorization vulnerability in TCMAN GIM

Vulnerability Description

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChangePassword%C3%B1a. To exploit the vulnerability the PasswordActual parameter must be empty.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-40668

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Jorge Riopedre Vega

References

More from TCMAN

View All →
CVE-2025-41015
User Enumeration vulnerability in TCMAN GIM
Medium 6.9
CVE-2025-41014
User Enumeration vulnerability in TCMAN GIM
Medium 6.9
CVE-2025-41013
SQL injection vulnerability in TCMAN GIM
High 8.7
CVE-2025-41012
Unauthorized access vulnerability in TCMAN GIM
High 8.7
CVE-2025-40670
Incorrect Authorization vulnerability in TCMAN GIM
High 7.1

Affected Vendor

Affected Software

GIM
Vulnerable Versions:
11

Timeline

Official Publish: June 9th, 2025
Last Modified: June 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-863

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion