CVE-2025-68721: Axigen WebAdmin Broken Access Control

Vulnerability Summary

A flaw in the permission logic allows an administrator account with zero permissions to access the "Security & Filtering" page, specifically the SSL Certificates endpoint. While other restricted sections are correctly blocked, this endpoint remains unauthorizedly accessible.

Affected Versions: < 10.6.26

For more info, see the Axigen Knowledge Base.

POC

Target URL: https://{axigen-domain}:9443/?_h={admin-token}&page=sslcerts

Steps to Reproduce:

1. Create an admin account with no permissions assigned.
2. Authenticate as the restricted admin.
3. Manually navigate to the sslcerts page using the URL above.

Result: The restricted user is granted access to view, download, upload, and delete certificate files.

Impact

• Unauthorized Certificate Management: Access to sensitive certificate data. Ability to swap or delete certificates, leading to man-in-the-middle.
• Attack Chaining: Access to this page allows a low-privileged user to upload malicious files to trigger XSS vulnerabilities against high-privileged administrators see.

---