Critical Vulnerability in Oracle Hospitality OPERA 5 (CVE-2025-21547)

Overview

CVE-2025-21547 is a critical vulnerability affecting multiple versions of Oracle Hospitality OPERA 5, specifically within the Opera Servlet component. This flaw allows unauthenticated remote attackers to compromise the system through HTTP, potentially leading to full access to sensitive data or denial-of-service (DoS) conditions.

Technical Details

The vulnerability exists in the way OPERA 5 handles HTTP requests within its servlet architecture. An attacker can exploit the flaw without authentication and with minimal complexity, simply by sending specially crafted HTTP requests over the network. The issue allows:

• Unauthorized access to critical or complete OPERA 5 data
• Remote execution of requests that can cause service hangs or repeatable crashes (DoS)

This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, indicating that it may allow attackers to overwhelm the application’s resources, affecting availability and performance.

Severity and CVSS

The vulnerability is rated 9.1 (Critical) on the CVSS v3.1 scale. The CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Confidentiality Impact: High
• Availability Impact: High

Affected Versions

The following versions of Oracle Hospitality OPERA 5 are affected:

• 5.6.19.20
• 5.6.25.8
• 5.6.26.6
• 5.6.27.1

All these versions are susceptible to the vulnerability and require immediate patching.

Mitigation and Recommendations

Oracle has released patches as part of its January 2025 Critical Patch Update (CPU). Organizations using affected versions should:

• Apply the latest Oracle CPU updates without delay.
• Restrict HTTP access to the OPERA 5 application from untrusted networks.
• Monitor network traffic and logs for abnormal behavior or exploitation attempts.

Conclusion

CVE-2025-21547 underscores the importance of timely patch management and secure application deployment, particularly in the hospitality sector where sensitive data and high availability are critical. Organizations running Oracle Hospitality OPERA 5 should take immediate action to mitigate the risk.

More information is available in the official Oracle advisory: Oracle CPU January 2025