Critical severity · published May 2, 2025
CVE-2025-3709
Flowring Technology Agentflow - Account Lockout Bypass
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perform password brute force attack.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
Agentflow · Flowring Technology
4.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3709
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3709
Third Party Advisory
https://www.twcert.org.tw/en/cp-139-10090-112f7-2.html
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-10091-12462-1.html
More from Agentflow
8.1
CVE-2025-11899
Flowring Technology｜Agentflow - Use of Hard-coded Cryptographic Key
7.5
CVE-2025-11898
Flowring Technology｜Agentflow - Arbitrary File Reading through Path Traversal