The vulnerability CVE-2025-53295 in iCount Payment Gateway versions up to 2.0.7 is due to missing authorization checks, which allows unauthenticated users to access certain functionality that should be restricted by ACLs. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is low. No patch or mitigation details are available from the vendor or other sources at this time.

An attacker can access functionality in the iCount Payment Gateway that should be protected by authorization controls, potentially leading to unauthorized modification of data or system behavior (integrity impact). There is no impact on confidentiality or availability reported. The vulnerability does not require authentication or user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected iCount Payment Gateway instances and monitor for unusual activity related to unauthorized access attempts. Avoid exposing the affected versions to untrusted networks.