CVE-2025-0077
Apache Struts Lock Screen Bypass Vulnerability
Description
In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
INFO
Published Date :
Sept. 4, 2025, 6:15 p.m.
Last Modified :
Sept. 5, 2025, 5:47 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Review and fix race conditions in UserController.
- Implement proper synchronization mechanisms.
- Test for lock screen bypass vulnerabilities.
- Deploy updated code.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-0077.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-0077 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-0077
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-0077 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-0077 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Sep. 04, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Added CWE CWE-1223 -
New CVE Received by [email protected]
Sep. 04, 2025
Action Type Old Value New Value Added Description In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Added Reference https://android.googlesource.com/platform/frameworks/base/+/37a4df78c7e1b91066b341b05fb767f27c5da835 Added Reference https://android.googlesource.com/platform/frameworks/base/+/3b04c948727c35e6ad429eefc6aaa9c261addf12 Added Reference https://android.googlesource.com/platform/frameworks/base/+/5f59ac63cb7042d58dae196e890ec52424ebe8b5 Added Reference https://android.googlesource.com/platform/frameworks/base/+/8c290a4d87c27a4ad65757e97ff9e634d9fe865e Added Reference https://android.googlesource.com/platform/frameworks/base/+/a09b6451c99f8aa99c49a0e584e12be455c414f4 Added Reference https://android.googlesource.com/platform/frameworks/base/+/c059123b8e9c0920a30f896513116a8b88bfc4e1 Added Reference https://source.android.com/security/bulletin/2025-05-01