CVE-2025-54943 is a critical missing authorization flaw in SUNNET Corporate Training Management System before version 10.11. The application does not check access rights on deployment, so remote attackers can perform unauthorized application deployment. Ask SUNNET Technology for version 10.11 or later and limit exposure meanwhile.
What's affected
- Product: SUNNET Corporate Training Management System, from SUNNET Technology Co., Ltd.
- Affected: versions before 10.11.
- Fixed: version 10.11 or later, per the version boundary in the record. The researcher's advisory says to contact SUNNET Technology for version updates, so ask the vendor for the current release and installation steps.
- What it allows: remote attackers can perform unauthorized application deployment because proper access control checks are missing.
This is one of five related findings published together by the same researcher team (CVE-2025-54942 through CVE-2025-54946). They affect the same product and the same version range, so one upgrade addresses all of them. Plan the work as a single change.
How to check if you're exposed
This is a vendor application, so check it where it is installed.
- Find the product version in the administration pages or the installer record, and compare it with 10.11.
- Ask your SUNNET Technology contact which release you are on and whether all five advisories are covered.
- Check whether the system is reachable from the internet. A training portal often is, because staff and contractors use it from outside.
- Look at web server logs for unusual requests to deployment or upload functionality from addresses you do not recognize.
Because the vendor ships it as a packaged system, a library scan will not see it. Add it to your asset inventory with an owner and a patch contact.
What to do now
- Contact SUNNET Technology and obtain version 10.11 or later, with the vendor's upgrade instructions.
- Take a backup of the application and its database before you upgrade.
- If you cannot upgrade immediately, restrict access to the system to trusted networks or a VPN, and place a web application firewall in front of it if you have one.
- Review the server for files you did not put there, in particular in upload and deployment locations, and review logs back to the start of September 2025 at least.
- Record the upgrade and the check in your vulnerability tracker, covering all five related CVEs.
Why it matters
The weakness is missing authorization. This differs from missing authentication. Authentication asks who you are. Authorization asks what you are allowed to do. A system can know exactly who is calling and still fail to check whether that person may deploy applications.
The common fix is a central access check that every route must pass, with a default of deny. When each endpoint decides for itself, one forgotten check is enough. Because this is paired with CVE-2025-54942 in the same release, treat deployment as the area to audit when you review the product and your own logs.
The researcher's advisory (ZA-2025-11) lists the mitigation as contacting the vendor for version updates, and gives no workaround. The CVE is not on the CISA KEV list.
The weakness is classed as CWE-862 (Missing Authorization). Severity in the CVE record: critical, CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Quick check
How is this different from CVE-2025-54942?
That one is missing authentication, meaning no login is needed. This one is missing authorization, meaning access rights are not checked. Both touch deployment and both are fixed by the same version boundary.
Which version fixes it?
The record says before 10.11 is affected. Ask SUNNET Technology for the current release and confirm.
Sources
Last reviewed: 18 October 2026.
