Listen to this Post
The vulnerability exists in TCMAN GIM v11 version 20250304. It involves the PDAWebService.asmx web service. This service exposes a SOAP action called UnlockUser. The action is accessible without authentication. Attackers can send SOAP requests to /WS/PDAWebService.asmx. The request uses the soapaction header set to UnlockUser. It includes parameters pda:userId and pda:newPassword. By manipulating the pda:userId parameter, attackers test user existence. The system responds differently for valid and invalid users. This allows unauthenticated user enumeration. The vulnerability is due to missing authentication checks. The web service processes requests without credentials. Responses may leak user existence via error messages. It is a classic information disclosure flaw. Exploitation can be performed remotely over networks. Attackers need no prior system knowledge. Repeated requests with different user IDs enumerate accounts. This can lead to further attacks like brute-forcing. The root cause is lack of authentication on the endpoint. It affects the PDA web service component specifically.
Platform: TCMAN GIM
Version: v11 20250304
Vulnerability: User enumeration vulnerability
Severity: Medium
Date: 12/02/2025
Prediction: Patch expected 2026
What Undercode Say:
Showing bash commands and codes related to the blog
curl -X POST -H “SOAPAction: UnlockUser” -H “Content-Type: text/xml” -d ‘
how Exploit:
Send SOAP requests enumerate users.
Protection from this CVE
Patch software restrict access.
Impact:
User information disclosure facilitates attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
