Synapse Mobility versions 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability that allows external control of web parameters. If exploited, this vulnerability enables a user to escalate their privileges and access unauthorized data by altering search function parameters.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2025-54551 |
Exploitation
To exploit this vulnerability, an attacker can manipulate the web parameters of the Synapse Mobility application. By sending specially crafted requests to the application, the attacker can escalate their privileges and gain access to sensitive data that they would not normally have permission to view.
Affected Products
- Synapse Mobility 8.0: Initial version with the vulnerability.
- Synapse Mobility 8.0.1: Minor update still vulnerable.
- Synapse Mobility 8.0.2: Another update that does not address the issue.
- Synapse Mobility 8.1: Major version with the same vulnerability.
- Synapse Mobility 8.1.1: Latest version still affected.
Mitigation
To mitigate this vulnerability, users should apply any available patches or updates provided by Synapse Mobility. Additionally, restricting access to the application and monitoring for unusual activity can help prevent exploitation until a fix is implemented.