ETQ Reliance CG Authentication Bypass via Trailing Space RCE

published 2025-07-22 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-22321

cvss: 9.3; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 38.0%; EPSS 38.0% chance of exploitation in 30 days, percentile 98%
public exploits: 0; none known, plus a Nuclei check

An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login page to obtain elevated access. Once authenticated, an attacker could achieve remote code execution by modifying Jython scripts within the application. This issue was resolved by introducing stricter validation logic to exclude internal accounts from public authentication workflows in version MP-4583.

Patch / fix

fixed in 1 links 1

ETQ Reliance CG (legacy) MP-4583

etq.com/blog/etq-reliance-security-update/ advisory

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 15 mo ago (2025-07-22)

Exploit prediction

38.04% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Nuclei template ETQ Reliance - Authentication Bypass via Trailing Space nuclei detection template

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

ETQ Reliance CG (legacy)

Classification

Weakness

CWE-288 Authentication Bypass Using an Alternate Path or Channel
CWE-269 Improper Privilege Management
CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

etq.com /blog/etq-reliance-security-update/
vendor-advisory, patch
etq.com /product-overview/
product
slcyber.io /assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-et
technical-description
vulncheck.com /advisories/etq-reliance-cg-authentication-bypass-via-trailing-space-rce
third-party-advisory

Sources

CVE List CVE-2025-34143
NVD CVE-2025-34143

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary