Vulnerability

CERT-In Vulnerability Note CIVN-2025-0082
Multiple Vulnerabilities in Meon products

Original Issue Date:April 23, 2025

Severity Rating: HIGH

Systems Affected

KYC Solutions - version 1.1
Bidding Solutions - version 1.2

Overview

Multiple vulnerabilities have been reported in Meon products, which could allow a remote attacker to perform brute force attack, captcha bypass, unauthorized data manipulation or gain unauthorized access to sensitive information of other user accounts.

Target Audience:
End-users of Meon KYC solutions and Bidding solutions.

Risk Assessment:
Data breach, identity theft and financial losses.

Impact Assessment:
Unauthorized access to other user accounts.

Description

Meon KYC solutions provide digital identity verification services like eKYC, Re-KYC, and Aadhaar eSign to enable seamless and paperless customer onboarding.

Meon Bidding solutions offered through eIPO platform provide the Initial Public Offering (IPO) application process for brokerage firms and investors by enabling online submissions with minimal paperwork.

1. Brute Force Attack Vulnerability ( CVE-2025-42600   )

This vulnerability exists in KYC solutions due to missing restrictions on the number of incorrect One-Time Password (OTP) attempts through certain API endpoints of login process. A remote attacker could exploit this vulnerability by performing a brute force attack on OTP, which could lead to gain unauthorized access to other user accounts.

2. Captcha Bypass Vulnerability ( CVE-2025-42601   )

This vulnerability exists in KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remote attacker could exploit this vulnerability by intercepting the request and removing the Captcha parameter leading to bypassing the Captcha verification mechanism.

3. Improper Authentication Vulnerability ( CVE-2025-42602   )

This vulnerability exists in KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentication process. A remote attacker could exploit this vulnerability by intercepting and manipulating the responses through API request body leading to unauthorized access of other user accounts.

4. Information Disclosure Vulnerability ( CVE-2025-42603   )

This vulnerability exists in the KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting API response that contains unencrypted sensitive information belonging to other users.
Successful exploitation of this vulnerability could allow remote attacker to impersonate the target user and gain unauthorized access to the user account.

5. Detailed Error Response Vulnerability ( CVE-2025-42604   )

This vulnerability exists in KYC solutions due to debug mode is enabled in certain API endpoints. A remote attacker could exploit this vulnerability by accessing certain unauthorized API endpoints leading to detailed error messages as response leading to disclosure of system related information.

6. Improper Access Control Vulnerability ( CVE-2025-42605   )

This vulnerability exists in Bidding Solutions due to improper authorization controls on certain API endpoints for the initiation, modification, or cancellation operations. An authenticated remote attacker could exploit this vulnerability by manipulating parameter in the API request body to gain unauthorized access to other user accounts.
Successful exploitation of this vulnerability could allow remote attacker to perform authorized manipulation of data associated with other user accounts.

Credit

These vulnerabilities are reported by Mohit Gadiya.

Solution

Upgrade KYC Solutions to version 1.2 and Bidding Solutions to version 1.3.

Vendor Information

Meon Technologies
https://meon.co.in/aadhaar-ekyc
https://meon.co.in/eipo

References

Meon Technologies
https://meon.co.in/aadhaar-ekyc
https://meon.co.in/eipo

CVE Name
CVE-2025-42600
CVE-2025-42601
CVE-2025-42602
CVE-2025-42603
CVE-2025-42604
CVE-2025-42605

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India