CVE-2025-65239

Medium · 4.3

CVSS

4.3

EPSS

0.3%

Published

Nov 26, 2025

CISA due date

—

The record

Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers with low-level privileges to read server logs.

Affected packages

Ecosystem	Package	Introduced	Fixed