CVE-2025-12461: Epsilonnet Authentication Bypass Flaw

CVE-2025-12461 Overview

CVE-2025-12461 is a broken access control vulnerability affecting Epsilon RH by Grupo Castilla. Unauthenticated attackers can reach application paths that lack access control enforcement. Specifically, the endpoint …/epsilonnet/License/About.aspx exposes licensing information and configuration data, including which product modules are installed. This information disclosure enables adversaries to fingerprint the deployment and plan follow-on attacks against known-vulnerable modules. The vulnerability is categorized under [CWE-522] and is reachable remotely over the network without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can enumerate license details and installed modules of Epsilon RH deployments, aiding targeted follow-on exploitation.

Affected Products

Epsilon RH by Grupo Castilla
Deployments exposing the epsilonnet/License/About.aspx endpoint
Web-facing Epsilon RH installations without upstream access controls

Discovery Timeline

2025-10-29 - CVE-2025-12461 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12461

Vulnerability Analysis

The vulnerability stems from missing authorization checks on administrative and informational endpoints within Epsilon RH. The About.aspx page under the epsilonnet/License/ path returns license metadata and module configuration without validating the requester's session or role. Attackers with only network access to the application can retrieve this data by requesting the URL directly.

Disclosed content includes the license status and the list of installed modules. This intelligence lets an attacker identify feature-specific components and map the deployment to known weaknesses. Broken access control ranks among the most impactful web application defects because it turns internal metadata into a public reconnaissance source.

Root Cause

The root cause is missing server-side authorization on informational pages. The application relies on obscurity of the URL path rather than enforced session, role, or IP-based checks. Any HTTP client that guesses or discovers the path retrieves the response.

Attack Vector

Exploitation requires only a network path to the target and a standard HTTP client. An attacker sends a GET request to …/epsilonnet/License/About.aspx and parses the response for license identifiers, customer information, and module inventory. See the INCIBE Security Notice for the coordinated disclosure record.

// No verified proof-of-concept code is published for CVE-2025-12461.
// The exploitation pattern is an unauthenticated HTTP GET request
// to the exposed path: /epsilonnet/License/About.aspx

Detection Methods for CVE-2025-12461

Indicators of Compromise

HTTP GET requests to /epsilonnet/License/About.aspx from unauthenticated or external sources
Access log entries showing repeated enumeration of paths under /epsilonnet/License/
Requests to the About page originating from IP ranges outside expected administrative networks
User-Agent strings associated with scanners such as curl, wget, nuclei, or httpx targeting the endpoint

Detection Strategies

Add web application firewall (WAF) rules to alert on any access to epsilonnet/License/About.aspx from unauthenticated clients
Baseline legitimate administrative access to the License path and alert on deviations
Correlate access-log entries with authentication events to identify sessions retrieving the page without a valid login

Monitoring Recommendations

Forward IIS or reverse-proxy access logs to a centralized logging platform for retention and search
Monitor for successful HTTP 200 responses to /epsilonnet/License/* endpoints from external networks
Track outbound traffic from hosts that queried the About page for signs of follow-on scanning or exploitation

How to Mitigate CVE-2025-12461

Immediate Actions Required

Contact Grupo Castilla to obtain the fixed release of Epsilon RH and apply it as soon as available
Restrict network access to the Epsilon RH application to trusted management networks or VPN users
Block unauthenticated access to /epsilonnet/License/About.aspx at the reverse proxy or WAF layer
Review web server access logs for prior access to the exposed endpoint

Patch Information

Refer to the INCIBE Security Notice for vendor coordination status and fixed version details. Administrators should engage Grupo Castilla support directly to confirm the remediated release for their deployment.

Workarounds

Enforce authentication at the reverse proxy for all paths under /epsilonnet/License/
Deploy WAF rules that return HTTP 403 for unauthenticated requests to informational pages
Place the Epsilon RH application behind a VPN or zero-trust access proxy to eliminate direct internet exposure
Remove or rename the About.aspx file if it is not required for operations

bash

# Example nginx configuration to block unauthenticated access to the exposed path
location ~* /epsilonnet/License/About\.aspx$ {
    allow 10.0.0.0/8;      # Administrative network
    deny  all;
    proxy_pass http://epsilon-backend;
}