Rapid Response Monitoring My Security Account App Authorization Bypass Through User-Controlled Key

published 2025-02-20 20 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-4565

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits: 0; none known

Rapid Response Monitoring My Security Account App utilizes an API that could be exploited by an attacker to modify request data, potentially causing the API to return information about other users.

Patch / fix

fixed in 1

Rapid Response Monitoring My Security Account App API 7/29/24

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-051-05 updated 2025-02-20 cvss 7.5

Rapid Response Monitoring My Security Account App

Rapid Response Monitoring My Security Account App API <7/29/24
affected: mitigation “Rapid Response Monitoring reports that this issue was patched on their end and no action is required by users. For further information, contact Rapid Response Monitoring.” rrms.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 20 mo ago (2025-02-20)

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Rapid Response Monitoring My Security Account App API

Classification

Weakness

CWE-639 Authorization Bypass Through User-Controlled Key

References

Sources

CVE List CVE-2025-0352
NVD CVE-2025-0352

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary