VULNERABILITY INTELLIGENCE

CVE-2025-2297

CVSS score7.8 HIGH
EPSS probability0.13%
CISA KEVNot currently listed
Published2025-07-28
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.

Weakness classification

  • 13061848-ea10-403d-bd75-c83a022c2891: CWE-268

Primary references