CVE-2025-65238: n/a
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 26% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 26 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
1. Implement strict access control policies ensuring that the getSubUsersByProvider function is accessible only to authorized high-privilege users. 2. Conduct thorough privilege audits to identify and restrict low-level user permissions that could be exploited. 3. Monitor and log all access to user records, with alerts for unusual or bulk data retrieval activities. 4. Apply network segmentation to limit exposure of the USSD gateway to trusted internal networks only. 5. Engage with OpenCode Systems for official patches or updates and apply them as soon as they become available. 6. Conduct regular security assessments and penetration testing focused on access control mechanisms. 7. Educate staff about the risks of privilege misuse and enforce strict operational security policies. 8. Consider implementing additional application-layer controls such as rate limiting and anomaly detection to detect exploitation attempts.
Description
Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackers with low-level privileges to dump user records and access sensitive information.