CVE Intelligence
Analysis AI-assisted

CVE-2025-7016: Akinsoft QR Menu Improper Access Control

CVE-2025-7016 is an improper access control weakness (CWE-284) in Akinsoft QR Menu, published by Akın Software. The record describes it as allowing authentication abuse and says it affects versions before s1.05.12. NVD scores it 9.8 under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an improper access control weakness (CWE-284) in Akinsoft QR Menu, a product from Akın Software Computer Import Export Industry and Trade Ltd. The description refers to authentication abuse and states that the issue affects versions before s1.05.12.

Impact

NVD assigns a CVSS 3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This vector describes network reachability, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. The CNA USOM lists a different score of 8 under CVSS 3.1. The record does not describe which data or functions could be reached.

Affected products and versions

  • Product: Akinsoft Qr Menu
  • Affected range recorded: versions before s1.05.12

The record has no separate fixed-version field. The affected range implies that s1.05.12 is the first version not covered, but this should be confirmed with the vendor or the advisories linked below.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Inventory all QR Menu installations and record their versions.
  • Plan an upgrade to s1.05.12 or a later version confirmed by the vendor or national advisories.
  • Until the upgrade is applied, limit access to administrative and management functions to trusted networks and review account and authorization settings.
  • Follow the guidance in the USOM advisory and the Siber Güvenlik advisory.

Detection guidance

  • Review application and web server logs for unusual access to management functions, especially from unexpected sources or accounts.
  • Monitor for changes to menu content, prices or user roles that authorized staff did not make.

Limitations of the available information

  • The record has no vendor-provided fixed-version field.
  • No EPSS, SSVC or KEV-based exploitation data is present in the record.
  • The record does not describe the vulnerable function or the exact steps of the authentication abuse.
  • The CVSS score of 8 from USOM has no vector listed in the record.

Frequently asked questions

Which versions of Akinsoft QR Menu are affected by CVE-2025-7016?

The record states that the issue affects QR Menu versions before s1.05.12. Confirm the exact range with the vendor or the linked advisories.

Is CVE-2025-7016 known to be actively exploited?

The record does not list the CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.