Velneo GServer/VAPPS Security Advisory: CVE-2025-114405 Malformed HTTP, Symlink Read & AWS Unauthorized Access

The following is a summary of key vulnerability intelligence: Vulnerability Overview 1. CVE-2025-114405 - Description: A "Malformed HTTP Packet in Velneo GServer" vulnerability was discovered in MielVelo v10. - Scope: Affects GServer versions from 36.0 to 37.0. - Remediation: Update GServer to versions 36.4 and 37.2. 2. CVE-2025-114482 - Description: An "Altixray File Read via Symlink" vulnerability was discovered in Velneo GServer. - Scope: Affects GServer versions from 32.0 to 37.0. - Remediation: Update GServer to versions 36.4 and 37.2. 3. CVE-2021-40020 - Description: A certificate validation failure due to missing domain verification was discovered in Velneo VAPPS. - Scope: Affects Velneo VAPPS. - Remediation: Upgrade to Velneo v32.2 or later and re-verify all certificates. 4. CVE-2021-40026 - Description: A certificate validation failure due to missing domain verification was discovered in Velneo VAPPS. - Scope: Affects Velneo VAPPS. - Remediation: Upgrade to Velneo v32.2 or later and re-verify all certificates. Security Incidents 1. June 10, 2024 - Incident: Unauthorized access to Velneo Cloud. - Scope: Affects Velneo Cloud. - Remediation: The issue has been resolved, and all affected customers have been notified. 2. June 10, 2024 - Incident: Unauthorized access via Amazon AWS infrastructure. - Scope: Affects Amazon AWS infrastructure. - Remediation: The issue has been resolved, and all affected customers have been notified. Additional Information Security Advisory: Provides detailed information on how to report vulnerabilities and understand security procedures. Privacy Policy: Provides a link to the privacy policy regarding data processing. The information above summarizes the key vulnerability details from the webpage screenshot, including the vulnerability overview, scope of impact, and remediation steps.

Goal Reached Thanks to every supporter — we hit 100%!

Velneo GServer/VAPPS Security Advisory: CVE-2025-114405 Malformed HTTP, Symlink Read & AWS Unauthorized Access