CVE-2025-2911 Overview
CVE-2025-2911 affects Fermax MeetMe products in versions prior to 2024-09. The vulnerability stems from unauthorised access to the call forwarding service system. Attackers with low-privilege access can identify multiple users through extension enumeration and perform brute force attacks against the service. The weakness is categorised under [CWE-307] (Improper Restriction of Excessive Authentication Attempts). The Spanish National Cybersecurity Institute (INCIBE) issued a public notice covering this flaw alongside other Fermax mobile application issues.
Critical Impact
Attackers can enumerate valid users through the call forwarding extension interface and iterate credential guesses without rate limiting, exposing MeetMe deployments to account compromise.
Affected Products
- Fermax MeetMe products in versions prior to 2024-09
- Fermax mobile applications integrating the MeetMe call forwarding service
- Deployments exposing the call forwarding extension interface over the network
Discovery Timeline
- 2025-03-28 - CVE-2025-2911 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2911
Vulnerability Analysis
The MeetMe call forwarding service exposes an extension-based interface without adequate authentication throttling. An attacker with network access and low privileges can query extensions to determine which correspond to valid users. Because the service does not restrict repeated authentication attempts, the same interface supports credential brute forcing. The issue combines two weaknesses: unauthenticated enumeration of user extensions and missing lockout controls on subsequent authentication attempts. Successful exploitation enables account takeover against identified extensions, providing a foothold into the intercom and call routing infrastructure.
Root Cause
The root cause is improper restriction of excessive authentication attempts [CWE-307]. The call forwarding service accepts unlimited requests against extension identifiers and does not enforce account lockouts, delays, or CAPTCHA challenges. Differential responses between valid and invalid extensions allow user enumeration before any credential guessing begins.
Attack Vector
Exploitation occurs over the network with low complexity. The attacker requires low-level privileges but no user interaction. After enumerating extensions through the exposed interface, the attacker iterates password candidates against confirmed users until valid credentials are obtained or account policies otherwise intervene.
No verified public proof-of-concept code is available. Consult the INCIBE Security Notice on Vulnerabilities for vendor-referenced technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-2911
Indicators of Compromise
- High-frequency authentication requests against the MeetMe call forwarding endpoint originating from a single source address.
- Sequential or dictionary-style probes against extension identifiers observed in application or reverse proxy logs.
- Sudden growth in failed authentication events tied to multiple distinct extensions within a short time window.
Detection Strategies
- Baseline normal request rates to the call forwarding service and alert on deviations exceeding the baseline.
- Correlate failed authentication events by source IP, user agent, and extension to surface enumeration and brute force patterns.
- Enable verbose logging on the MeetMe service to capture per-extension request outcomes for downstream analysis.
Monitoring Recommendations
- Forward MeetMe and upstream network device logs to a centralised SIEM for retention and correlation.
- Monitor for authentication anomalies against the call forwarding service, including off-hours activity and geographic outliers.
- Track lockout, throttling, and CAPTCHA trigger events once mitigations are deployed to validate control effectiveness.
How to Mitigate CVE-2025-2911
Immediate Actions Required
- Upgrade Fermax MeetMe products to the 2024-09 release or later, which addresses the enumeration and brute force conditions.
- Restrict network exposure of the call forwarding service to trusted management networks or VPN clients.
- Review authentication logs for signs of prior enumeration or brute force activity and reset affected credentials.
Patch Information
Fermax addresses this issue in MeetMe releases dated 2024-09 and later. Reference the INCIBE Security Notice on Vulnerabilities for the coordinated advisory covering CVE-2025-2911 and the associated Fermax mobile application issues.
Workarounds
- Place the MeetMe interface behind a reverse proxy that enforces rate limiting and account lockout on repeated failed authentications.
- Enforce strong password policies and rotate credentials for all provisioned extensions to reduce brute force success probability.
- Segment the intercom infrastructure from general user networks to limit reachability of the call forwarding service.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
