CVE-2025-0425— Local Privilege Escalation via Config Manipulation
Quick assessment
Affected
Cordaware bestinformed Infoclient
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cordaware bestinformed是德国Cordaware公司的一套群发通知系统。 Cordaware bestinformed存在安全漏洞，该漏洞源于服务器地址修改权限问题，可能导致本地权限提升至SYSTEM。
Possible ATT&CK Techniques 3 AI
T1552.004 · Private Keys T1068 · Exploitation for Privilege Escalation T1136.001 · Local Account
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-0425
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Local Privilege Escalation via Config Manipulation
Source: CVE Program / CVE List V5
Vulnerability Description
Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed Server" to which this client connects. This is dangerous as the "bestinformed Infoclient" runs with elevated permissions ("nt authority\system"). By changing the server address to a malicious server, or a script simulating a server, the user is able to escalate his privileges by abusing certain features of the "bestinformed Web" server. Those features include:
* Pushing of malicious update packages
* Arbitrary Registry Read as "nt authority\system"
An attacker is able to escalate his privileges to "nt authority\system" on the Windows client running the "bestinformed Infoclient".
This attack is not possible if a custom configuration ("Infoclient.ini") containing the flags "ShowOnTaskbar=false" or "DisabledItems=stPort,stAddress" is deployed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
系统设置或配置在外部可控制
Source: CVE Program / CVE List V5
Vulnerability Title
Cordaware bestinformed 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cordaware bestinformed是德国Cordaware公司的一套群发通知系统。 Cordaware bestinformed存在安全漏洞，该漏洞源于服务器地址修改权限问题，可能导致本地权限提升至SYSTEM。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cordaware | bestinformed Infoclient | 0 ~ 6.3.7.0 | - |
|
II. Public POCs for CVE-2025-0425
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-0425
请登录查看更多情报信息。
Vendor Pages for CVE-2025-0425 (1)
-
Changelog > Infoclient > Version 6.3.8.1 vendor-advisory
Same Patch Batch · Cordaware · 2025-02-18 · 4 CVEs total
| CVE-2025-0422 | Authenticated Remote Code Execution via ScriptVar | |
| CVE-2025-0423 | Multiple Unauthenticated Stored Cross-Site Scripting | |
| CVE-2025-0424 | Multiple Authenticated Stored Cross-Site Scripting |
IV. Related Vulnerabilities
Same weakness: CWE-15
-
CVE-2026-16708
IBM Db2 Mirror for i is affected by multiple vulnerabilities -
CVE-2026-73661
FreePBX: Authenticated Framework AUTHTYPE Can Be Restored Fr -
CVE-2026-66065
Ouroboros: Untrusted project .env can still reach RCE via om -
CVE-2026-56567
HCL iControl is affected by multiple security vulnerabilitie -
CVE-2026-46485
Dash: Users can write to config despire permissions (OIDC te
V. Comments for CVE-2025-0425
No comments yet