UPDATE:
Following the publication of these vulnerabilities and the subsequent CVE assignments, the CVE identifiers have now been revoked. The vendor (EQS Group) contacted the CVE Program (via a CNA) and disputed the records, stating that the affected product is an exclusively hosted SaaS platform with no customer-managed deployment or versioning. Based on this argument, the CVE Program concluded that CVE assignment is “not a suitable solution for vulnerability identification” in this case, as customers do not take direct action to apply fixes. In other words, because the service is centrally hosted and patched at the provider’s discretion, the vulnerabilities are no longer considered eligible for CVE tracking, despite being real, independently discovered, responsibly disclosed, and acknowledged by the vendor. The vendor has stated that fixes are being implemented and that private customer notifications will be issued internally. While remediation is of course welcome, this outcome highlights a broader issue: vulnerabilities in SaaS platforms can effectively disappear from public vulnerability tracking, simply because the deployment model removes user agency, a model that arguably incentivizes security through obscurity, rather than transparency. The technical findings remain valid. This update is shared purely for accuracy and record-keeping. On Sun, Jan 4, 2026 at 4:40 PM <[email protected] [[email protected]]> wrote: > UPDATE: > > > The reported vulnerabilities have now been assigned CVE identifiers: > CVE-2025-34411: https://www.cve.org/cverecord?id=CVE-2025-34411 > [https://www.cve.org/cverecord?id=CVE-2025-34411] > CVE-2025-34412: https://www.cve.org/cverecord?id=CVE-2025-34412 > [https://www.cve.org/cverecord?id=CVE-2025-34412] _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
