Overview
A critical vulnerability has been identified in the GPM (Generic Process Management) system from WormHole Tech. This flaw, listed as CVE-2025-4558, allows unauthenticated remote attackers to alter any user’s password and subsequently log into the system using the modified password. As such, the vulnerability poses a significant risk to the confidentiality, integrity, and availability of systems running the affected GPM software. Given the high CVSS Severity Score and the broad impact of a successful exploit, it is crucial for organizations to understand and address this vulnerability promptly.
Vulnerability Summary
CVE ID: CVE-2025-4558
Severity: Critical (9.8/10)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise and data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
WormHole Tech GPM | All versions prior to patch release
How the Exploit Works
The CVE-2025-4558 vulnerability exploits a weakness in the password change mechanism of the GPM system. Specifically, it fails to properly verify the legitimacy of password change requests. As a result, an unauthenticated remote attacker can send a specially crafted request to the GPM system to change any user’s password without proving their identity or the ownership of the account. This, in turn, allows the attacker to log into the system as the targeted user and potentially gain unauthorized access to sensitive data or even take over the system.
Conceptual Example Code
Here is a conceptual example illustrating how an attacker might exploit this vulnerability. It represents a malicious HTTP POST request to change a user’s password:
POST /gpm/password/change HTTP/1.1
Host: target.example.com
Content-Type: application/json
{
"username": "admin",
"new_password": "malicious_password"
}In this example, the attacker tries to change the password of the ‘admin’ account to ‘malicious_password’. If successful, the attacker can then log into the system as ‘admin’ using the new password.