This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: CVE-2025-26853 is a critical security flaw in DESCOR INFOCAD. It stems from a broken **Authorization Mechanism**. ๐ **Consequences**: The system fails to verify user permissions correctly.โฆ
๐ก๏ธ **Root Cause**: The core issue is **CWE-863: Incorrect Authorization**. The software does not properly enforce access controls. Users can access resources they are not entitled to.โฆ
๐ข **Affected Entities**: The vulnerability impacts **DESCOR INFOCAD FM**. Specifically, versions **3.5.1 and earlier** are at risk. Any organization using these older versions for BIM or facility management is exposed.โฆ
๐ **Attacker Capabilities**: Hackers can achieve **Full System Compromise**. With a CVSS score indicating High impact on C/I/A, they can: ๐ Read sensitive BIM data. โ๏ธ Modify critical facility records.โฆ
โก **Exploitation Threshold**: The bar is **Extremely Low**. The CVSS vector shows: ๐ Network Accessible (AV:N). ๐ No Privileges Required (PR:N). ๐ซ No User Interaction Needed (UI:N). ๐ Low Complexity (AC:L).โฆ
๐ **Public Exploit Status**: Currently, **No Public PoC/Exploit** is listed in the data. However, the low complexity and lack of auth requirements make it highly attractive.โฆ
๐ **Self-Check Method**: Scan your infrastructure for **DESCOR INFOCAD FM** instances. Check the version number against **3.5.1**. If you are running v3.5.1 or older, you are vulnerable.โฆ
๐ฉน **Official Fix**: The vendor, Descor, has acknowledged the issue. A changelog entry titled "broken authorization schema" exists on their site. You must update to the **latest patched version** immediately.โฆ
๐ง **No Patch Workaround**: If you cannot patch immediately: ๐ซ Restrict network access to the INFOCAD server. Use a **Firewall** to block external traffic. Implement strict **Network Segmentation**.โฆ
๐ฅ **Urgency Level**: **CRITICAL / IMMEDIATE ACTION REQUIRED**. The CVSS score is effectively 10.0 (High C/I/A, Low AC, No Auth). This is a remote code execution-level risk for data integrity. Do not delay.โฆ