PT-2025-10002 · Netsweeper · Netsweeper Server

Published 2025-03-06 · Updated 2025-03-07 · CVE-2025-25497

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Netsweeper Server versions prior to 8.2.7

Description The issue in the account management interface allows unauthorized changes to the Account Owner field due to client-side-only restrictions and a lack of server-side validation. This enables account ownership reassignment to or away from any user.

Recommendations For versions prior to 8.2.7, update to version 8.2.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the account management interface until the update is applied.

Fix

Weakness Enumeration

CWE-602

Related Identifiers

CVE-2025-25497

Affected Products

Netsweeper Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-25497 · Security Note
• https://packetstorm.news/files/id/188626 · Note
• https://twitter.com/VulmonFeeds/status/1897784521526747498 · Twitter Post
• https://helpdesk.netsweeper.com/docs/8_2_Docs/8_2_Netsweeper_Docs/Content/Release_Notes/Netsweeper_Release_Notes/8_2_Release_Notes/8_2_7_Release_and_Downloads.htm · Note
• https://t.me/cvenotify/113916 · Telegram Post
• https://twitter.com/CVEnew/status/1897912323488252089 · Twitter Post
• https://twitter.com/CVETracker/status/1898101532656013664 · Twitter Post
• https://t.me/cvedetector/19756 · Telegram Post