CVE-2025-21547: Critical Remote Exploit in Oracle Hospitality OPERA 5

Overview

On January 21, 2025, Oracle disclosed a critical vulnerability identified as CVE-2025-21547 in the Oracle Hospitality OPERA 5 system, a widely used platform in the hospitality industry for property management. The vulnerability affects versions 5.6.19.20, 5.6.25.8, 5.6.26.6, and 5.6.27.1. It is remotely exploitable by unauthenticated attackers over HTTP and carries a CVSS v3.1 base score of 9.1, rated as Critical.

Technical Details

This vulnerability resides in the Opera Servlet component and is classified under CWE-400: Uncontrolled Resource Consumption. An unauthenticated attacker can send specially crafted HTTP requests that either grant unauthorized access to sensitive data or trigger a complete Denial-of-Service (DoS) by overloading system resources.

The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, which translates to:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: High

Impact

Successful exploitation can lead to:

• Unauthorized access to critical and sensitive hospitality data
• Total denial of service (DoS), crashing the OPERA 5 application
• Operational disruption of hotel management systems and guest services

Given the central role OPERA 5 plays in reservation, billing, and room management, the impact on affected organizations could be severe.

Affected Versions

• Oracle Hospitality OPERA 5 version 5.6.19.20
• Oracle Hospitality OPERA 5 version 5.6.25.8
• Oracle Hospitality OPERA 5 version 5.6.26.6
• Oracle Hospitality OPERA 5 version 5.6.27.1

Mitigation

Oracle addressed this vulnerability in its January 2025 Critical Patch Update. Organizations should:

• Apply the latest patches immediately
• Restrict external HTTP access to OPERA instances
• Monitor for signs of resource exhaustion or unusual HTTP activity

Conclusion

CVE-2025-21547 highlights the ongoing risks of web-facing enterprise software, especially in sectors like hospitality where uptime and data integrity are mission-critical. Prompt patching and hardening of network access controls are essential to prevent potential data breaches and service outages.