# CVE-2025-7358: Utarit SoliClub hard-coded credentials allow authentication abuse

Source: https://junglewise.ai/threats/cve-2025-7358-utarit-soliclub-hard-coded-credentials-allow-authentication-abuse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-18. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-7358 · Severity: high · CVSS 7.5 · Published 2025-12-18

Utarit SoliClub, a platform used for campus and corporate smart card management and mobile payments, contains a security flaw where login credentials are permanently embedded in the software. An unauthorized person could use these fixed credentials to bypass security measures and gain access to the system. This could lead to the unauthorized viewing of user data or abuse of account services.

Technologies: [Utarit Soliclub](https://junglewise.ai/threats/technologies/soliclub). Vendors: [Utarit](https://junglewise.ai/threats/vendors/utarit).

## Quick answers

**Is CVE-2025-7358 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-7358 being exploited in the wild.

**How severe is CVE-2025-7358?** High severity, with a CVSS score of 7.5, published 18 December 2025.

**Which products and versions are affected?** Utarit Informatics Services Inc. SoliClub before 5.3.7.

**Is there a fix for CVE-2025-7358?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-7358 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-7358?** Check whether you run Utarit Soliclub. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use of hard-coded credentials vulnerability (CWE-798) exists in Utarit SoliClub before version 5.3.7. The application contains static, embedded authentication secrets that can be discovered through reverse engineering or static analysis of the software. A remote, unauthenticated attacker can utilize these credentials to bypass standard authentication mechanisms and gain unauthorized access to the application's functions or data. The vulnerability is exploitable over the network without user interaction. Users are advised to update to version 5.3.7 or later to remediate this issue.

## Affected products

- Utarit Informatics Services Inc. SoliClub before 5.3.7

## Timeline

- 2025-12-18: disclosed
- 2025-12-18: advisory

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0466](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0466)
- [https://www.usom.gov.tr/bildirim/tr-25-0466](https://www.usom.gov.tr/bildirim/tr-25-0466)

## Related threats

- [Utarit Informatics Services SoliClub missing authorization](https://junglewise.ai/threats/cve-2025-7047-utarit-informatics-services-soliclub-missing-authorization)
- [Utarit SoliClub authorization bypass via user-controlled key](https://junglewise.ai/threats/cve-2025-1031-utarit-soliclub-authorization-bypass-via-user-controlled-key)
- [Utarit SoliClub information exposure in query system](https://junglewise.ai/threats/cve-2025-1030-utarit-soliclub-information-exposure-in-query-system)
- [Utarit SoliClub hard-coded credentials in executable](https://junglewise.ai/threats/cve-2025-1029-utarit-soliclub-hard-coded-credentials-in-executable)