CVE-2025-6056

Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackers to enumerate usernames.

Score

CVSS 4.0 6.9 Medium

Status

Deferred - vulnerability@ncsc.ch

Published

2025-07-04

Last modified

2025-07-07

Weaknesses

CWE-203

Affected products

• Airlock Iam (Ergon Informatik Ag)

References

• https://www.redguard.ch/blog/2025/07/04/cve-2025-6056-airlock-iam-username-enumeration/