CVE-2025-7897 is a high (CVSS 7.3) missing authentication in the API in harry0703 MoneyPrinterTurbo (MoneyPrinterTurbo up to 1.2.6). The record names no fixed version, so plan on isolating or replacing it. Do not expose the product to untrusted networks until you have confirmed a fix.
What's affected
The record lists MoneyPrinterTurbo up to 1.2.6 as affected. The vulnerable code is in app/controllers/base.py (function verify_token).
No fixed version is named in the record. Check the project's releases for anything newer than 1.2.6.
The record says the verify_token function in the API endpoint layer fails to enforce authentication, so a remote caller may reach functions that should need a token. This is the sibling of CVE-2025-7895 in the same product and version range.
The record's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, a score of 7.3. The VulDB page the record links returned an access error, so this post relies on the NVD record.
The record's kev flag is false, so the CVE is not in CISA's Known Exploited Vulnerabilities catalog at the time of this review.
How to check if you're exposed
Find the model and firmware version on the device's status page or, if you manage many devices, in your asset inventory. Then confirm whether the management interface is reachable from outside your network. From a machine outside your perimeter:
nmap -Pn -p 23,80,443,8080 YOUR_PUBLIC_ADDRESS
If the web management port answers from the internet, treat the device as exposed whatever its firmware says.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether this CVE appears in a project's dependency list. Note that it covers packages. Stand-alone applications and firmware are best checked against your own inventory.
What to do now
- Confirm whether you run MoneyPrinterTurbo and which version.
- Do not expose the API to the internet. Put it behind a VPN or a reverse proxy that enforces authentication.
- Check the project's releases for a version newer than 1.2.6 and read its notes for an authentication fix.
- Rotate any API keys stored in the application's configuration.
- Review request logs for calls from addresses you do not recognize.
If you maintain a codebase and want to know whether a vulnerable package is actually called, Safeguard's reachability analysis separates packages that are present from code paths that are used.
Why it matters
The weakness class here is CWE-287 (improper authentication), CWE-306 (missing authentication for a critical function). A function that changes a security relevant setting has to check who is calling it. When the check is missing, being able to reach the service is the only barrier.
Quick check
Is there a patch for CVE-2025-7897?
The record does not name a fixed version, and for PAD CMS CERT Polska says none will be published. Treat the product as unpatched, reduce its exposure and check the vendor or project site for news.
Is CVE-2025-7897 being exploited in the wild?
The record's kev flag is false, so it is not in CISA's Known Exploited Vulnerabilities catalog. No advisory I read says it is being exploited.
Sources
- Safeguard Gold entry for CVE-2025-7897
- VulDB entry 317012 listed in the record (listed in the record, not retrievable when reviewed)
- NVD record data for CVE-2025-7897, published 2025-07-20, source cna@vuldb.com
Last reviewed: 18 October 2026.
