CVE-2025-63958
📋 TL;DR
MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes an unauthenticated configuration endpoint that leaks sensitive information including database credentials, file share paths, and license server details. This allows attackers to potentially compromise the entire system by accessing these credentials. All users running the vulnerable version are affected.
💻 Affected Systems
- MILLENSYS Vision Tools Workspace
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through credential theft leading to database access, file system infiltration, and lateral movement within the network
Likely Case
Database compromise, sensitive data exfiltration, and potential ransomware deployment through stolen credentials
If Mitigated
Limited information disclosure without authentication bypass, but still exposes system architecture details
🎯 Exploit Status
Exploitation requires only web browser or curl command to access the endpoint
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.millensys.com/
Restart Required: No
Instructions:
Check vendor website for security updates. No official patch available at time of analysis.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to the MILLENSYS application using firewall rules
# Windows: netsh advfirewall firewall add rule name="Block MILLENSYS" dir=in action=block protocol=TCP localport=80,443 remoteip=any
# Linux: iptables -A INPUT -p tcp --dport 80,443 -j DROP
Web Server Configuration
allAdd authentication requirement to /MILLENSYS/settings endpoint
# Apache: <Location "/MILLENSYS/settings">
AuthType Basic
AuthName "Restricted"
Require valid-user
</Location>
# Nginx: location /MILLENSYS/settings {
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
}
🧯 If You Can't Patch
- Immediately isolate the MILLENSYS server from internet access and restrict internal network access
- Change all database credentials, file share passwords, and license server credentials exposed by the vulnerability
🔍 How to Verify
Check if Vulnerable:
Access http://[server-ip]/MILLENSYS/settings in browser or using curl. If it returns configuration data without authentication, system is vulnerable.Check Version:
Check application version in software interface or installation directoryVerify Fix Applied:
Attempt to access the endpoint after applying controls. Should return 401/403 error or require authentication.📡 Detection & Monitoring
Log Indicators:
- Multiple GET requests to /MILLENSYS/settings from unauthenticated users
- Database connection attempts from unexpected IP addresses
Network Indicators:
- Unusual outbound connections from MILLENSYS server to database or file share systems
- Traffic to /MILLENSYS/settings endpoint without prior authentication
SIEM Query:
source="web_logs" AND url="/MILLENSYS/settings" AND (user="-" OR auth_status="failed")