CVE-2025-67418: n/a hardcoded default admin creds

CISO Take

ClipBucket 5.5.2 ships with hardcoded default administrative credentials, letting any unauthenticated remote attacker log into the admin panel and gain full control of the application — no exploit development, no user interaction, nothing but a browser and a known default password. The CVSS 9.8 (network, low complexity, no privileges, no user interaction) reflects that this is as close to a walk-in-the-front-door vulnerability as exists; the only reason it isn't a slam-dunk breaking alert is a low EPSS score (0.0044, top-65th percentile) and no confirmed public exploit, PoC, or Nuclei template yet, meaning mass scanning hasn't clearly picked it up — though default-credential checks are trivial to add to any scanner and often aren't tracked individually. This class of flaw is a recurring anti-pattern in self-hosted admin dashboards for media and ML/data platforms, where an exposed management UI with factory credentials becomes the single point of full compromise. Action: rotate/disable any default admin account on ClipBucket deployments immediately, confirm no instance was deployed with defaults still in place (check web/audit logs for admin logins from unfamiliar IPs), and track vendor guidance for a credential-reset or patched release since no fixed version is documented in the available advisory.

Sources: NVD EPSS ATLAS

What is the risk?

Exploitability is maximal on paper: CVSS 9.8, network vector, no authentication or user interaction required, and the technique (try published/known default creds against the admin login) requires no specialized skill. Actual near-term risk is tempered by a low EPSS score (0.44%, ~65th percentile) and absence of a confirmed public exploit or Nuclei template, suggesting opportunistic mass exploitation hasn't yet been observed at scale — but default-credential attacks are cheap enough to add to any scanner or botnet at any time, so this can change with no additional research effort by an attacker. Any internet-facing ClipBucket 5.5.2 instance that has not rotated the shipped credentials should be treated as already compromised until proven otherwise.

How does the attack unfold?

Reconnaissance

Attacker identifies internet-facing ClipBucket 5.5.2 instances via fingerprinting/scanning.

AML.T0006

Initial Access

Attacker logs into the admin panel using hardcoded/default administrative credentials without authentication barriers.

AML.T0012

Privilege Escalation / Control

Admin panel access grants full administrative control over the application, including configuration and account management.

AML.T0049

Impact

Attacker leverages full admin control to persist access, alter data, or pivot into connected systems and stored content.

Reconnaissance

Attacker identifies internet-facing ClipBucket 5.5.2 instances via fingerprinting/scanning.

AML.T0006

Initial Access

Attacker logs into the admin panel using hardcoded/default administrative credentials without authentication barriers.

AML.T0012

Privilege Escalation / Control

Admin panel access grants full administrative control over the application, including configuration and account management.

AML.T0049

Impact

Attacker leverages full admin control to persist access, alter data, or pivot into connected systems and stored content.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n/a	—	—	No patch

Do you use n/a? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Immediately change or disable the default administrative account/credentials on every ClipBucket 5.5.2 deployment — do not assume an install-time prompt already handled this. 2) Restrict access to the /admin panel via network controls (IP allowlist, VPN, reverse-proxy auth) so it is not reachable from the open internet. 3) Audit admin login logs for authentications from unexpected IPs or at unexpected times since deployment. 4) Check vendor/GitHub advisories for a patched release or official guidance (none is listed in the referenced advisory); if unavailable, compensating controls (network isolation, credential rotation, MFA in front of the panel via reverse proxy) are required. 5) Add a check for this pattern (default creds not rotated) to routine asset/config audits, since it is not detectable by traditional vulnerability scanning alone.

How is it classified?

Auth Bypass API AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - Third-party and customer requirements / secure system access control

NIST AI RMF

GOVERN 1.5 / MANAGE 4.1 - Risk management processes for third-party/deployed AI-supporting systems

OWASP LLM Top 10

N/A - Not directly applicable

Frequently Asked Questions

What is CVE-2025-67418?

ClipBucket 5.5.2 ships with hardcoded default administrative credentials, letting any unauthenticated remote attacker log into the admin panel and gain full control of the application — no exploit development, no user interaction, nothing but a browser and a known default password. The CVSS 9.8 (network, low complexity, no privileges, no user interaction) reflects that this is as close to a walk-in-the-front-door vulnerability as exists; the only reason it isn't a slam-dunk breaking alert is a low EPSS score (0.0044, top-65th percentile) and no confirmed public exploit, PoC, or Nuclei template yet, meaning mass scanning hasn't clearly picked it up — though default-credential checks are trivial to add to any scanner and often aren't tracked individually. This class of flaw is a recurring anti-pattern in self-hosted admin dashboards for media and ML/data platforms, where an exposed management UI with factory credentials becomes the single point of full compromise. Action: rotate/disable any default admin account on ClipBucket deployments immediately, confirm no instance was deployed with defaults still in place (check web/audit logs for admin logins from unfamiliar IPs), and track vendor guidance for a credential-reset or patched release since no fixed version is documented in the available advisory.

Is CVE-2025-67418 actively exploited?

No confirmed active exploitation of CVE-2025-67418 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-67418?

1) Immediately change or disable the default administrative account/credentials on every ClipBucket 5.5.2 deployment — do not assume an install-time prompt already handled this. 2) Restrict access to the /admin panel via network controls (IP allowlist, VPN, reverse-proxy auth) so it is not reachable from the open internet. 3) Audit admin login logs for authentications from unexpected IPs or at unexpected times since deployment. 4) Check vendor/GitHub advisories for a patched release or official guidance (none is listed in the referenced advisory); if unavailable, compensating controls (network isolation, credential rotation, MFA in front of the panel via reverse proxy) are required. 5) Add a check for this pattern (default creds not rotated) to routine asset/config audits, since it is not detectable by traditional vulnerability scanning alone.

What systems are affected by CVE-2025-67418?

This vulnerability affects the following AI/ML architecture patterns: Self-hosted admin/management dashboards, Media and data management platforms with web-based admin UIs.

What is the CVSS score for CVE-2025-67418?

CVE-2025-67418 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

Self-hosted admin/management dashboardsMedia and data management platforms with web-based admin UIs

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 1.5 / MANAGE 4.1

OWASP LLM Top 10: N/A

What are the technical details?

Original Advisory

ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the administrative panel using these default credentials, resulting in full administrative control of the application.

Exploitation Scenario

An attacker scans the internet for exposed ClipBucket instances (via Shodan/Censys fingerprinting or simple HTTP banner detection), navigates to the admin login page, and attempts the vendor's documented or leaked default administrative username/password. Because the credentials were never rotated at deployment, the login succeeds immediately with no rate-limiting or MFA in the way. From the admin panel the attacker can create additional accounts for persistence, modify site configuration, upload arbitrary files (a common secondary vector in admin panels of this type), and access any data or connected storage the platform manages — achieving full compromise of the application and potentially a foothold into the hosting environment, all without writing a single exploit.