CVE-2025-24924 GMOD Apollo Missing Authentication for Critical Function

CriticalCVSS 9.3 EPSS 0.57%

Published: 2025-03-05 02:02
Updated: 2026-06-17 11:59
Exploit status: No public exploit known

Sign in for asset impact Search another CVE

Description

Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username

Affected products

Product	Affected versions	Fixed in
gmod Apollo	< 2.8.0	2.8.0

References

www.cisa.gov

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (4)

v4.0 9.3 · icscert
v4.0 9.3 · ics-cert@hq.dhs.gov
v3.1 9.8 · icscert
v3.1 9.8 · ics-cert@hq.dhs.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.57% (percentile 47.4)
CWE: CWE-306 Missing Authentication for Critical Function

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.