CVE-2025-34143

ETQ Reliance on the legacy CG (compliance generation) platform fails to validate the username field during login, allowing an unauthenticated attacker to authenticate as the privileged internal SYSTEM account, which requires no password. An attacker with network access to the login page simply submits the internal account name to bypass authentication entirely and gain elevated access to the application. Once authenticated, the attacker can achieve remote code execution on the server by modifying the Jython scripts that the application executes. All deployments of the legacy CG platform prior to patch MP-4583 are affected, and no special privileges or user interaction are required. No public proof-of-concept or confirmed in-the-wild exploitation is known, but the elevated EPSS score (~32% probability of exploitation within 30 days, 98th percentile) suggests defenders should prioritize remediation.

What to do: Upgrade ETQ Reliance legacy CG deployments to patch MP-4583 or later, which excludes internal accounts like SYSTEM from public authentication workflows. Until patched, restrict network access to the login page via firewall rules or VPN, and review authentication logs for logins to the SYSTEM account and unexpected changes to Jython scripts. After patching, verify no unauthorized scripts or accounts were left behind on previously exposed instances.