CVE-2025-49080

Description

There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of packets to the server. The attack complexity is low, there are no attack requirements, privileges, or user interaction required. Loss of availability is high; there is no impact on confidentiality or integrity.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-762 CWE-762

Affected Products

Vendor	Product	Versions
absolute	secure_access	9.0 — 13.54

References

Advisories & Patches

https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-49080

Frequently Asked Questions

What is CVE-2025-49080? +

There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of packets to the server. The attack complexity is low, there are no attack requirements, privileges, or user interaction required. Loss of availability is high; there is no impact on confidentiality or integrity. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2025-49080? +

CVE-2025-49080 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-49080? +

CVE-2025-49080 affects products from absolute, specifically: secure_access. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-49080? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-32503 8.4

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos …

CVE-2023-41056 8.1

Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in …

CVE-2024-2955 7.8

T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or …

CVE-2025-48431 7.5

Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are …

CVE-2025-20189 7.4

A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers …

CVE-2025-11015 5.3

A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. …