CVE-2025-22956

CVSS 9.8 CRITICALEPSS 0.3%CWE-200

Vexday Risk Score

28Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 9.8EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

08 set 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients. This can lead to privilege escalation if any ProductPropertyState contains a secret only intended to be accessible by a subset of clients. One example of this is a domain join account password for the windomain package.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

n/a · n/a

Referências

https://opsi.org/en/product/releases/#4.3-20250129054911