Goal Reached Thanks to every supporter β€” we hit 100%!

Goal: 1000 CNY Β· Raised: 1000 CNY

100.0%

CVE-2025-26853 β€” AI Deep Analysis Summary

CVSS 10.0 Β· Critical

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: CVE-2025-26853 is a critical security flaw in DESCOR INFOCAD. It stems from a broken **Authorization Mechanism**. πŸ“‰ **Consequences**: The system fails to verify user permissions correctly.…

Q2Root Cause? (CWE/Flaw)

πŸ›‘οΈ **Root Cause**: The core issue is **CWE-863: Incorrect Authorization**. The software does not properly enforce access controls. Users can access resources they are not entitled to.…

Q3Who is affected? (Versions/Components)

🏒 **Affected Entities**: The vulnerability impacts **DESCOR INFOCAD FM**. Specifically, versions **3.5.1 and earlier** are at risk. Any organization using these older versions for BIM or facility management is exposed.…

Q4What can hackers do? (Privileges/Data)

πŸ’€ **Attacker Capabilities**: Hackers can achieve **Full System Compromise**. With a CVSS score indicating High impact on C/I/A, they can: πŸ”“ Read sensitive BIM data. ✏️ Modify critical facility records.…

Q5Is exploitation threshold high? (Auth/Config)

⚑ **Exploitation Threshold**: The bar is **Extremely Low**. The CVSS vector shows: 🌐 Network Accessible (AV:N). πŸ”“ No Privileges Required (PR:N). 🚫 No User Interaction Needed (UI:N). πŸ“‰ Low Complexity (AC:L).…

Q6Is there a public Exp? (PoC/Wild Exploitation)

πŸ” **Public Exploit Status**: Currently, **No Public PoC/Exploit** is listed in the data. However, the low complexity and lack of auth requirements make it highly attractive.…

Q7How to self-check? (Features/Scanning)

πŸ”Ž **Self-Check Method**: Scan your infrastructure for **DESCOR INFOCAD FM** instances. Check the version number against **3.5.1**. If you are running v3.5.1 or older, you are vulnerable.…

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: The vendor, Descor, has acknowledged the issue. A changelog entry titled "broken authorization schema" exists on their site. You must update to the **latest patched version** immediately.…

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: If you cannot patch immediately: 🚫 Restrict network access to the INFOCAD server. Use a **Firewall** to block external traffic. Implement strict **Network Segmentation**.…

Q10Is it urgent? (Priority Suggestion)

πŸ”₯ **Urgency Level**: **CRITICAL / IMMEDIATE ACTION REQUIRED**. The CVSS score is effectively 10.0 (High C/I/A, Low AC, No Auth). This is a remote code execution-level risk for data integrity. Do not delay.…