Description
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.
Affected products
aenrich: a\+hrd
References3
- www.twcert.org.tw/en/cp-139-10487-12a32-2.html Third Party Advisory
- www.twcert.org.tw/tw/cp-132-10486-a3459-1.html Third Party Advisory
- www.chtsecurity.com/news/b97e8337-6b0c-43e8-8e8c-187b7c0e13c2 Press/Media CoverageThird Party Advisory
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0
-
9.3
CRITICAL
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 50 · as of 10 November 2026
- CWE
- CWE-1390
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.