CVE-2025-26817

Published Apr 3, 2025

Last updated 16 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-26817 is an OS command injection vulnerability found in Netwrix Password Secure version 9.2.0.32454. The vulnerability allows an attacker to execute arbitrary operating system commands on the affected system. Successful exploitation could lead to unauthorized access, data theft, system compromise, and potentially using the system as a launching point for further network attacks. An authenticated attacker can create a malformed shared document which when opened by the target user can result in arbitrary code execution.

Description: Netwrix Password Secure 9.2.0.32454 allows OS command injection.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:netwrix:password_secure:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5EF3F164-0C88-4F42-9C40-0615AF122C36",
            "versionEndExcluding": "9.2.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.