{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "title": "OPEXUS FOIAXpress unauthenticated administrator password reset",
    "tracking": {
      "current_release_date": "2025-10-16T16:43:55Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.10.0"
        }
      },
      "id": "VA-25-289-01",
      "initial_release_date": "2025-10-16T16:43:55Z",
      "status": "final",
      "version": "1.0.0",
      "revision_history": [
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2025-10-16T16:43:55Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors",
        "category": "other"
      },
      {
        "text": "OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password and gain full administrative access to a vulnerable system.",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "text": "Update to FOIAXpress version 11.13.2.0 or later.",
        "title": "Recommended Practices",
        "category": "general"
      },
      {
        "text": "United States",
        "title": "Company Headquarters Location",
        "category": "other"
      }
    ],
    "references": [
      {
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-289-01.json",
        "summary": "Vulnerability Advisory VA-25-289-01 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "OPEXUS",
        "branches": [
          {
            "category": "product_name",
            "name": "FOIAXpress",
            "branches": [
              {
                "category": "product_version_range",
                "name": ">=11.1.0|<11.13.2.0",
                "product": {
                  "name": "OPEXUS FOIAXpress >=11.1.0|<11.13.2.0",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "11.13.2.0",
                "product": {
                  "name": "OPEXUS FOIAXpress 11.13.2.0",
                  "product_id": "CSAFPID-0002"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-62586",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "summary",
          "text": "OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:Y/T:T/2025-10-16T16:25:30Z/"
        }
      ],
      "title": "OPEXUS FOIAXpress unauthenticated administrator password reset",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ],
        "fixed": [
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "11.13.2.0 Release Notes",
          "url": "https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.2.0.pdf"
        },
        {
          "category": "external",
          "summary": "VA-25-289-01",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-289-01.json"
        },
        {
          "category": "external",
          "summary": "CVE-2025-62586",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-62586"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 11.13.2.0. Tracked as FX_PALC_25Q31-1 and 1303264.",
          "url": "https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.2.0.pdf",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2025-08-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 11.13.2.0. Tracked as FX_PALC_25Q31-1 and 1303264.",
          "url": "https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.2.0.pdf",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2025-08-08T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "organization": "CISA",
          "names": [
            "Matthew Zamat"
          ]
        }
      ],
      "release_date": "2025-10-16T00:00:00Z"
    }
  ]
}