PatchTheCVEussd gateway vulnerabilities and fixes
Recent CVEs affecting ussd gateway, with upgrade or downgrade steps. 6 tracked.
Also searched as: ussdgateway.
ussd gateway has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-03-05. Highest priority: CVE-2025-65236 (score 58/100).
- CVE-2025-70614 HIGH 8.1 DOWNGRADE OpenCode Systems OC Messaging / USSD Gateway OC Release 6.32.2 contains a broken access control vulnerability
- CVE-2025-65239 MEDIUM 4.3 DOWNGRADE Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, ver
- CVE-2025-65238 MEDIUM 6.5 DOWNGRADE Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5
- CVE-2025-65237 MEDIUM 6.1 DOWNGRADE A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows atta
- CVE-2025-65236 CRITICAL 9.8 DOWNGRADE OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Se
- CVE-2025-65235 CRITICAL 9.8 DOWNGRADE OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerab
FAQ
How do I fix ussd gateway vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ussd gateway being exploited right now?
None of the tracked ussd gateway CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ussd gateway CVE should I patch first?
CVE-2025-65236 currently ranks highest (58/100): OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Se.