Back to overview

CVE-2025-64180

CRITICAL
10.0
CVSS 3.1
Description
Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits unauthorized access to internal network resources. The flaw lies in the fundamental design of the DNS validation mechanism. A Time-of-Check Time-of-Use (TOCTOU) condition that allows attackers to bypass network isolation and access internal services, cloud metadata endpoints, and protected network segments. The Desktop edition requires no authentication; the Server edition requires only standard authentication. This issue is fixed in version 25.11.1.3086.

Metadata

CVE ID
CVE-2025-64180
State
PUBLISHED
Assigner
GitHub_M
Reserved
2025-10-28 21:07 UTC
Published
2025-11-07 02:58 UTC
Last updated
2026-01-07 17:09 UTC
Primary CWE
CWE-367
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vendor / Product
Manager-io / Manager
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Manager-io Manager — < 25.11.1.3086
Weakness (CWE)
CWESourceDescription
CWE-367 cna CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-918 cna CWE-918: Server-Side Request Forgery (SSRF)
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (1)
Back to overview