Is CVE-2025-15070 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15070 being exploited in the wild.

How severe is CVE-2025-15070?

Medium severity, with a CVSS score of 5.5, published 29 December 2025.

Which products and versions are affected?

Gmission Web Fax from 3.0 before 3.0.1.

Is there a fix for CVE-2025-15070?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-15070 attacked?

It is attacked with local access or over the network, in a web application.

Am I affected by CVE-2025-15070?

Check whether you run Gmission Web Fax at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15070: Gmission Web Fax missing authorization in authentication module

CVE-2025-15070 · Severity: medium · CVSS 5.5 · Published 2025-12-29

Gmission Web Fax, a digital faxing solution, contains a security vulnerability that could allow unauthorized access to sensitive information. An attacker with basic access to the system could bypass authorization checks to view data they are not permitted to see. This could lead to the exposure of private fax communications or other confidential administrative information.

Technologies: Gmission Web Fax. Vendors: Gmission.

Quick answers

Is CVE-2025-15070 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15070 being exploited in the wild.
How severe is CVE-2025-15070?: Medium severity, with a CVSS score of 5.5, published 29 December 2025.
Which products and versions are affected?: Gmission Web Fax from 3.0 before 3.0.1.
Is there a fix for CVE-2025-15070?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-15070 attacked?: It is attacked with local access or over the network, in a web application.
Am I affected by CVE-2025-15070?: Check whether you run Gmission Web Fax at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Gmission Web Fax versions 3.0 prior to 3.0.1 are vulnerable to CWE-862 (Missing Authorization) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw allows an authenticated user with low privileges to bypass authorization mechanisms and access sensitive data or abuse authentication functions. While some assessments suggest a network attack vector, the primary CNA reporting indicates a local attack vector (AV:L) requiring low privileges (PR:L). The vulnerability was addressed in version 3.0.1.

Affected products

Gmission Web Fax from 3.0 before 3.0.1

Timeline

2025-12-29: advisory: Initial publication of CVE-2025-15070

References

https://www.gmission.co.kr/fax1

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.