OpenCode Systems OC Messaging and USSD Gateway

aruschman

Mar 26, 2026

Release Date

March 26, 2026

Description

View CSAF

Summary

Successful exploitation of this vulnerability could allow an authenticated low-privileged user to gain access to SMS messages outside of their authorized tenant scope via a crafted company or tenant identifier parameter.

The following versions of OpenCode Systems OC Messaging and USSD Gateway are affected:

OC Messaging 6.32.2 (CVE-2025-70614)

USSD Gateway 6.32.2 (CVE-2025-70614)

CVSS Vendor Equipment Vulnerabilities

v3 8.1 OpenCode Systems OpenCode Systems OC Messaging and USSD Gateway Improper Access Control

Background

Critical Infrastructure Sectors: Communications

Countries/Areas Deployed: Worldwide

Company Headquarters Location: Bulgaria

Vulnerabilities

Expand All +

CVE-2025-70614

OpenCode Systems Custom Messaging Gateway 6.32.2 contains a web access vulnerability allowing one authenticated user to gain access to another authenticated user's messages via a…