---
id: CVE-2025-14117
title: A vulnerability has been found in fit2cloud Halo 2.21.10
summary: >-
  A vulnerability has been found in fit2cloud Halo 2.21.10. Impacted is an
  unknown function. The manipulation leads to cross-site request forgery. The
  attack may be initiated remotely. The exploit has been disclosed to the public
  and may b…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-352
  - CWE-862
  - CWE-352
vendor: fit2cloud
product: halo
affected:
  - halo = 2.21.10
published: '2025-12-06'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T20:10:00.197'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14117'
references:
  - url: 'https://blksword.flowus.cn/'
    label: cna@vuldb.com
  - url: 'https://github.com/BlkSword/POC'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.334494'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.334494'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.697391'
    label: cna@vuldb.com
  - url: 'https://github.com/BlkSword/POC'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00242
epssPercentile: 0.15281
ingestedAt: '2026-10-27T18:12:09.295Z'
---

## Overview

A vulnerability has been found in fit2cloud Halo 2.21.10. Impacted is an unknown function. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `halo = 2.21.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.