CVE-2025-65239

Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers with low-level privileges to read server logs.

Score

CVSS 3.1 4.3 Medium

Status

Analyzed - cve@mitre.org

Published

2025-11-26

Last modified

2025-11-26

Weaknesses

CWE-284

Affected products

• Ussd Gateway (Opencode)

References

• https://eslam3kl.gitbook.io
• https://eslam3kl.gitbook.io/blog/web-application-findings/cve-2025-65239-ussd-gateway-broken-access-control-logs
• https://github.com/eslam3kl