Synapse Mobility versions 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 have a privilege escalation vulnerability that allows external control of Web parameters. If exploited, this vulnerability enables a user to escalate their privileges and access unauthorized data by manipulating search function parameters.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2025-54551 |
Exploitation
To exploit this vulnerability, an attacker can manipulate the Web parameters of the Synapse Mobility application. By altering the parameters used in the search function, the attacker can escalate their privileges and gain access to sensitive data that they are not authorized to view.
Affected Products
- Synapse Mobility 8.0: Initial version with the vulnerability.
- Synapse Mobility 8.0.1: Minor update still containing the vulnerability.
- Synapse Mobility 8.0.2: Another update that does not address the vulnerability.
- Synapse Mobility 8.1: Version with the same vulnerability present.
- Synapse Mobility 8.1.1: Latest version still affected by the issue.
Mitigation
To mitigate this vulnerability, users should ensure they are using the latest version of Synapse Mobility that addresses this issue. Additionally, restricting access to the application and monitoring for unusual activity can help reduce the risk of exploitation.