CVE-2025-10223 — Improper Session Cleanup on Role Removal in Web Admin Panel in AxxonSoft Axxon One (C-Werk)

CVE-2025-10223

Improper Session Cleanup on Role Removal in Web Admin Panel in AxxonSoft Axxon One (C-Werk) PUBLISHED

Description (CNA)

Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticated attacker to retain access with removed privileges via continued use of an unexpired session token until natural expiration.

Affected (CNA)

Vendor / product	Versions
AxxonSoft / AxxonOne C-Werk	affected 0 through 2.0.3

CWE

CWE-613

References

https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.