CVE-2025-12871

The vulnerability results from a flawed mechanism for generating or verifying administrative access tokens in the A+HRD application. An attacker can remotely, without possessing any credentials, independently construct (craft) a properly formatted administrator access token. The token prepared in this way is accepted by the system, resulting in obtaining full administrative privileges without going through the proper authentication process.

An attacker gains unauthorized access to the system with administrator privileges, enabling the reading, modification or deletion of sensitive personnel and payroll data, as well as further actions in the victim's environment.

Apply patches available from the vendor in accordance with the references (TWCERT: https://www.twcert.org.tw/en/cp-139-10487-12a32-2.html). Until the fix is implemented, it is recommended to restrict access to the A+HRD system only to trusted IP addresses through a firewall or VPN.

A+HRD system developed by aEnrich; specific versions indicated in the vendor's references.