High severity · published May 29, 2025
CVE-2025-4687
Account pre-hijacking through invite misuse
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
In Teltonika Networks Remote Management System (RMS), it is possible to perform account pre-hijacking by misusing the invite functionality. If a victim has a pending invite and registers to the platform directly, they are added to the attackers company without their knowledge. The victims account and their company can then be managed by the attacker.This issue affects RMS: before 5.7.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RM
RMS · Teltonika Networks
before 5.7 · source: vendor