PT-2025-13240 · Kingsoft · Wps Office

Publicado 2025-03-27 · Atualizado 2025-03-27 · CVE-2025-2516

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Crítica

Vetor base

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Amber

Name of the Vulnerable Software and Affected Versions WPS Office (Kingsoft) versions (affected versions not specified)

Description The issue involves the use of a weak cryptographic key pair in the signature verification process, allowing an attacker who successfully recovered the private key to sign components. Additionally, older versions of the software did not validate the update server's certificate, making them vulnerable to Adversary-In-The-Middle attacks, which could result in updates being hijacked.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2025-2516

Produtos afetados

Wps Office

Referências · 6

• https://twitter.com/cybercronai/status/1905341755895034305 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1905300637824549373 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-2516 · Nota de Segurança
• https://twitter.com/CveFindCom/status/1905274101498798225 · Publicação no Twitter
• https://t.me/cvedetector/21303 · Publicação no Telegram
• https://welivesecurity.com/en/eset-research/nspx30-sophisticated-aitm-enabled-implant-evolving-since-2005 · Nota