CVE-2025-65238: Improper Access Control
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 12:55 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 26% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 26 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Implement strict access control policies ensuring that the getSubUsersByProvider function is accessible only to authorized high-privilege users.
- Conduct thorough privilege audits to identify and restrict low-level user permissions that could be exploited.
- Monitor and log all access to user records, with alerts for unusual or bulk data retrieval activities.
- Apply network segmentation to limit exposure of the USSD gateway to trusted internal networks only.
- Engage with OpenCode Systems for official patches or updates and apply them as soon as they become available.
- Conduct regular security assessments and penetration testing focused on access control mechanisms.
- Educate staff about the risks of privilege misuse and enforce strict operational security policies.
- Consider implementing additional application-layer controls such as rate limiting and anomaly detection to detect exploitation attempts.
Description
Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackers with low-level privileges to dump user records and access sensitive information.