CVE-2025-3550: Internet Doctor Workstation Auth Bypass

CVE-2025-3550 Overview

CVE-2025-3550 is an improper authorization vulnerability in the wowjoy (浙江湖州华卓信息科技有限公司) Internet Doctor Workstation System version 1.0. The flaw resides in unknown functionality of the /v1/pushConfig/detail/ endpoint. An authenticated remote attacker with low privileges can manipulate the request to access resources outside their intended authorization scope. The exploit has been publicly disclosed. According to the reference material, the vendor was contacted early about this disclosure but did not respond.

Critical Impact
Remote attackers holding low-privilege credentials can bypass authorization checks on /v1/pushConfig/detail/ to access configuration data intended for higher-privileged users.

Affected Products

wowjoy Internet Doctor Workstation System 1.0
Vendor: 浙江湖州华卓信息科技有限公司 (Zhejiang Huzhou Huazhuo Information Technology Co., Ltd.)
Affected component: /v1/pushConfig/detail/ API endpoint

Discovery Timeline

2025-04-14 - CVE-2025-3550 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3550

Vulnerability Analysis

The vulnerability is classified under [CWE-266: Incorrect Privilege Assignment]. The affected /v1/pushConfig/detail/ endpoint fails to enforce proper authorization checks on incoming requests. A remote attacker with valid low-privileged credentials can invoke the endpoint and retrieve or interact with data the account should not be able to access.

The issue impacts confidentiality of push configuration details exposed through the API. Integrity and availability are not directly affected based on the published vector. Because the vendor has not responded to the disclosure, no official fix or patched version is available at the time of writing.

Root Cause

The root cause is missing or insufficient authorization logic in the request handler for /v1/pushConfig/detail/. The application appears to authenticate the caller but does not validate whether that caller's role or scope permits access to the requested resource. This maps directly to the broken access control class of flaws.

Attack Vector

Exploitation requires network access to the application and a low-privilege authenticated session. No user interaction is required. The attacker issues a crafted HTTP request to /v1/pushConfig/detail/ and receives configuration data despite lacking the required authorization. Public disclosure of the technique lowers the barrier for opportunistic exploitation. Technical detail is available in the GitHub Issue Report and VulDB entry #304591.

Detection Methods for CVE-2025-3550

Indicators of Compromise

Unexpected HTTP requests to /v1/pushConfig/detail/ originating from low-privileged accounts.
Access log entries showing successful responses on the endpoint for users outside administrative roles.
Repeated enumeration patterns against /v1/pushConfig/ sub-paths.

Detection Strategies

Correlate authentication logs with API access logs to identify accounts accessing resources beyond their role scope.
Implement anomaly detection on request rates and response sizes for the /v1/pushConfig/detail/ route.
Review web application firewall logs for direct requests to internal configuration endpoints.

Monitoring Recommendations

Enable verbose logging on the API gateway for all /v1/pushConfig/* paths, capturing user identity and role claims.
Alert on any 200-series response to /v1/pushConfig/detail/ from non-administrative session tokens.
Forward web and application logs to a centralized SIEM for retention and long-term correlation.

How to Mitigate CVE-2025-3550

Immediate Actions Required

Restrict network access to the Internet Doctor Workstation System to trusted clinical networks only.
Place the application behind an authenticating reverse proxy that enforces role-based access on /v1/pushConfig/*.
Rotate credentials for low-privileged accounts and audit their recent activity against the affected endpoint.

Patch Information

No vendor patch is available. Public references indicate that the vendor did not respond to the disclosure. Organizations running wowjoy Internet Doctor Workstation System 1.0 should track vendor communications and apply an official fix as soon as one is released. Refer to VulDB CTI ID #304591 for update tracking.

Workarounds

Block or rate-limit external access to /v1/pushConfig/detail/ at the perimeter or WAF layer.
Enforce authorization at an upstream reverse proxy using group or role claims from the identity provider.
Segment the workstation system on a dedicated VLAN with strict east-west firewall rules.
Disable or remove any low-privilege service accounts that do not require API access.

bash

# Example NGINX rule restricting the vulnerable endpoint to an admin ACL
location /v1/pushConfig/detail/ {
    allow 10.0.10.0/24;   # admin subnet
    deny  all;
    proxy_pass http://backend_workstation;
}