CVE-2025-34467 describes a denial-of-service vulnerability in ZwiiCMS prior to version 13.7.00. The issue arises because the application acquires a temporary lock on administrative resources when a low-privilege authenticated user requests an admin page, even though the user is not authorized to access it. This lock is associated with the attacker's session and prevents other users from accessing the locked functionality until the session terminates or the attacker navigates away. The root cause is improper authorization combined with flawed resource state management, classified under CWE-667 (Improper Locking) and CWE-863 (Incorrect Authorization).

The vulnerability allows a low-privilege authenticated user to cause a denial-of-service condition by locking administrative resources, thereby blocking legitimate users, including administrators, from accessing certain functionalities. This can disrupt administrative operations but does not escalate privileges or allow unauthorized data access. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to trusted users only and monitor for unusual locking behavior. Avoid allowing low-privilege users to access administrative endpoints. No official patch or workaround has been published by the vendor as of now.