CVE-2025-35981

Imagine your business has an internal “operator” role for managing systems. This bug means that an operator with the right kind of access might still be able to look at some cardholder personal details they weren’t supposed to see. It doesn’t automatically break the system, but it can expose sensitive data to the wrong authorized person.

This matters if your organization uses or hosts Command Centre Server and you have user accounts with “Operator” privileges. The problem is about access to cardholder personal data when authorization boundaries aren’t enforced properly. The risk is mainly internal to your allowed users/roles (i.e., it requires a privileged Operator path), and findings do not indicate internet-only exposure.

This is a privacy/control issue, not a publicly demonstrated remote takeover problem. There is no KEV entry and no public exploit code on record, so there’s no sign of active widespread exploitation. Treat it as important to fix via access-control hardening and vendor patch follow-up, but not as an emergency requiring immediate downtime.

1. Confirm exposure (version check)

   • Log into the environment and identify the installed Command Centre Server version.
   • Determine whether it matches one of the known affected versions: 9.30.1874 (MR1), 9.20.2337 (MR3), or 9.10.3194 (MR6).

2. Confirm whether your configuration involves privileged operators

   • Identify which users/groups have “Operator” privileges.
   • Confirm whether those operators can view any cardholder personal details via the Command Centre Server interface.

3. Patch status and upgrade path

   • Our findings do not include any fix/patch information for CVE-2025-35981.
   • Contact your vendor/support team with the CVE ID and the exact version you run, and ask for:
     • whether a fixed release exists for your branch, and
     • the recommended upgrade procedure and any compatibility notes.

4. Temporary workaround while waiting for a patch

   • Reduce “Operator” privileges to the minimum required users.
   • Ensure role-based permissions for cardholder data viewing are limited to only those roles that need that capability.
   • If your system supports it, use separate operator roles for tasks that do not require access to cardholder personal details.

5. Verification after changes

   • After permission changes, re-check that operator accounts cannot view cardholder personal data outside their intended scope.

6. What to monitor

   • Review Command Centre Server logs for cardholder-data viewing actions by operator accounts.
   • Flag unusual access patterns (for example, operators viewing cardholder details outside normal workflows) for internal review.

7. Communications and documentation

   • Document what version you run, what access-control changes you made, and the vendor’s response regarding a patch for CVE-2025-35981.

CVE-2025-35981 (CWE-359) is a private personal information exposure caused by improper authorization/permission boundary enforcement in Command Centre Server. The mechanism described is that a privileged Operator can view limited personal data about a Cardholder that they would not normally be permitted to view. Confirmed exploited activity is not indicated: KEV is not listed and there is no public exploit code on record. EPSS is a low predicted likelihood (do not treat as a sign of active compromise). Affected versions explicitly called out are 9.30.1874 (MR1), 9.20.2337 (MR3), and 9.10.3194 (MR6). No fix details or fixed version numbers are available from the provided sources, so remediation is primarily access control/least privilege until vendor guidance is received.