CVE-2018-12025 describes a logic error in the transferFrom function of the FuturXE (FXE) ERC20 token smart contract, allowing unauthorized transfer of digital assets. This vulnerability, affecting FuturXE, stems from an incorrect boolean judgment that enables attackers to bypass allowance restrictions and transfer any amount of tokens from any account without the victim's private key. Rated 7.5 HIGH on CVSS, this vulnerability has a network attack vector (AV:N) and low attack complexity (AC:L), indicating it can be exploited remotely with ease. The potential impact is high on integrity (I:H) due to unauthorized asset transfers, though confidentiality and availability are unaffected. There is no evidence of active exploitation, and no public exploit code exists on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness and attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:futurxe:futurxe:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.