CVE-2025-65238 is a vulnerability identified in the OpenCode Systems USSD Gateway OC Release 5 Version 6.13.11, specifically within the getSubUsersByProvider function. This function suffers from incorrect access control, classified under CWE-284, which allows attackers possessing low-level privileges to bypass intended restrictions and dump user records. The vulnerability enables unauthorized disclosure of sensitive user information, compromising confidentiality without affecting integrity or availability. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector (AV:N), low attack complexity (AC:L), requiring privileges (PR:L), no user interaction (UI:N), and impacting confidentiality only (C:H/I:N/A:N). Exploitation does not require user interaction and can be performed remotely, making it a significant concern for organizations relying on this USSD gateway for mobile communication services. No patches or known exploits are currently available, indicating the need for proactive mitigation. The vulnerability could be leveraged by malicious insiders or low-privilege external attackers to harvest sensitive user data, potentially facilitating further attacks or privacy violations.

For European organizations, particularly telecom operators and mobile service providers using OpenCode Systems USSD Gateway OC Release 5 Version 6.13.11, this vulnerability poses a risk of sensitive user data exposure. Confidentiality breaches can lead to privacy violations, regulatory non-compliance (e.g., GDPR), reputational damage, and potential financial penalties. Since USSD gateways are integral to mobile network services, exploitation could undermine customer trust and service integrity. Although the vulnerability does not affect system availability or integrity, the unauthorized disclosure of user records could facilitate identity theft, targeted phishing, or social engineering attacks. The impact is heightened in countries with strict data protection laws and large mobile user bases. Organizations may also face increased scrutiny from regulators if they fail to address this vulnerability promptly.

1. Implement strict access control policies ensuring that the getSubUsersByProvider function is accessible only to authorized high-privilege users. 2. Conduct thorough privilege audits to identify and restrict low-level user permissions that could be exploited. 3. Monitor and log all access to user records, with alerts for unusual or bulk data retrieval activities. 4. Apply network segmentation to limit exposure of the USSD gateway to trusted internal networks only. 5. Engage with OpenCode Systems for official patches or updates and apply them as soon as they become available. 6. Conduct regular security assessments and penetration testing focused on access control mechanisms. 7. Educate staff about the risks of privilege misuse and enforce strict operational security policies. 8. Consider implementing additional application-layer controls such as rate limiting and anomaly detection to detect exploitation attempts.