CyberSecBulletin

SecurEnvoy vulnerabilities

We track 2 vulnerabilities in SecurEnvoy products across 3 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on March 19, 2025.

2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score

Latest SecurEnvoy vulnerabilities

  • 8.6 High severity

    SecurAccess: External Control of Assumed-Immutable Web Parameter

    CVE-2025-30236SecurEnvoy

    Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) if an HTTP POST request contains a SESSION parameter.

  • 7.5 High severity

    mfa: Cleartext Transmission of Sensitive Information

    CVE-2024-37393SecurEnvoyEPSS 3.3%

    Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the D