Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-0556— Telerik Report Server Clear Text Transmission of Agent Commands

Quick assessment

Affected
Progress Software Telerik Report Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Progress Telerik Report Server是美国Progress公司的一种企业级报表管理和分发解决方案。 Progress Telerik Report Server 2025 Q1版本之前存在安全漏洞，该漏洞源于当使用较旧的.NET Framework实现时，服务代理进程和应用程序主机进程之间的非敏感信息通信通过未加密的隧道进行，该隧道可能会受到本地网络流量嗅探。

CVSS 8.8 · High EPSS 0.31% · P22

Possible ATT&CK Techniques 1 AI

T1040 · Network Sniffing
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-0556

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Telerik Report Server Clear Text Transmission of Agent Commands
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent process and app host process occurs over an unencrypted tunnel, which can be subjected to local network traffic sniffing.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文传输
Source: CVE Program / CVE List V5
Vulnerability Title
Progress Telerik Report Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Progress Telerik Report Server是美国Progress公司的一种企业级报表管理和分发解决方案。 Progress Telerik Report Server 2025 Q1版本之前存在安全漏洞，该漏洞源于当使用较旧的.NET Framework实现时，服务代理进程和应用程序主机进程之间的非敏感信息通信通过未加密的隧道进行，该隧道可能会受到本地网络流量嗅探。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Progress Software Telerik Report Server 1.0.0 ~ 2025 Q1 (11.0.25.211) -

II. Public POCs for CVE-2025-0556

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-0556

请登录查看更多情报信息。

Vendor Advisories for CVE-2025-0556 (1)

Same Patch Batch · Progress Software · 2025-02-12 · 7 CVEs total

CVE-2024-11343 8.3 HIGH Telerik Document Processing Path Traversal
CVE-2024-12251 7.8 HIGH Improper neutralization special element in hyperlinks
CVE-2025-0332 7.8 HIGH Progress UI for WinForms decompression path traversal vulnerability
CVE-2024-11629 7.1 HIGH Telerik Document Processing RTF Export of Arbitrary File Path
CVE-2024-12629 4.1 MEDIUM Prototype Pollution in Progress® Telerik® KendoReact
CVE-2024-11628 4.1 MEDIUM Prototype Pollution in Progress® Telerik® Kendo UI for Vue

IV. Related Vulnerabilities

Same product: Telerik Report Server
Same vendor: Progress Software
Same weakness: CWE-319

V. Comments for CVE-2025-0556

No comments yet

Leave a comment