CVE-2025-40664 is a critical missing authentication flaw in TCMAN GIM, with a CVSS score of 9.1. INCIBE says TCMAN fixed it in the 20241112 release. Treat any instance reachable from untrusted networks as exposed until you have confirmed the fix, and review your logs for unexpected requests.
What's affected
- Product: TCMAN GIM version 11. INCIBE lists the affected resource as GIM, 11 version.
- Fixed version: INCIBE says TCMAN fixed these vulnerabilities in the 20241112 release.
- Severity: Critical, CVSS 9.1 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
- Weakness: CWE-306.
- Published: 2025-05-26.
The record says an unauthenticated attacker could reach three resources on the user management page: /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser and /frmGestionUser.aspx/DeleteUser. That means reading, changing and deleting user accounts without logging in.
INCIBE advisory INCIBE-2025-0270 covers four GIM CVEs. This is the critical one. CVE-2025-40665 and CVE-2025-40666 are time-based blind SQL injection, and CVE-2025-40667 is a missing authorization flaw.
How to check if you're exposed
The advisory does not give a command for reading the installed version, and this is a vendor-supplied product, so the useful check is administrative:
- Find the version or build number your organisation runs.
- Compare it with the fixed version in the advisory.
- If you cannot read the build number yourself, ask the vendor to confirm in writing.
You can also run your dependency manifests and container images through the free in-browser scan to see which known CVEs affect the packages you ship. It will not find a flaw inside a vendor appliance or an unmanaged install, so keep an inventory of those too.
What to do now
- Identify every copy of TCMAN GIM you run, including test and forgotten ones.
- Confirm that your GIM build is the 20241112 release or later, and review the user list for accounts you did not create.
- Until that is done, remove public access where you can. Put the application behind a VPN, a network allow list or a web application firewall rule, and watch the access and database logs for unusual requests to the endpoint named above.
- Record the outcome, including the date, the version you ended on and who confirmed it, so a later audit has something to read.
- Add the product to your continuous monitoring so a future CVE against it reaches you without a manual search.
Why it matters
Missing authentication means a function that should require a login can be called by anyone who knows its address. Nothing has to be guessed or bypassed, because the check was never there. The class is catalogued as CWE-306 (missing authentication for a critical function).
The cause is usually a design gap, not a coding slip: pages are protected by the menu that links to them instead of by a check on the server for every request. The fix is to enforce authentication and authorization on the server for each sensitive call, including the ones the interface never shows.
The record's KEV flag is false, so CISA does not list it as known to be exploited, and nothing in the sources here says it is being exploited in the wild.
Try it yourself
See how the exploitability check step works in practice.
Click through it at your own pace, or open it full screen.
Quick check
What does the score of 9.1 mean for TCMAN GIM?
The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N reads as network reachable, low complexity, no privileges and no user interaction. The impact ratings are confidentiality high, integrity high, availability none. Use it to rank the work, then confirm exposure for your own deployment.
If the page is not linked from the menu, is it hidden?
No. Hiding a link is not access control. Anyone who knows or guesses the address can send a request to it, so the server has to check who is asking on every call.
Sources
Last reviewed: 18 October 2026.
