PT-2025-11086 · 1E · 1E Client

Simeon Bunchev · Published 2025-03-12 · Updated 2026-01-30 · CVE-2025-1683

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: 1E Client versions prior to 25.3

Description: The issue is related to improper link resolution before file access in the Nomad module, allowing an attacker with local unprivileged access on a Windows system to delete arbitrary files by exploiting symbolic links.

Recommendations: For versions prior to 25.3, update to version 25.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Nomad module to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2025-07417

CVE-2025-1683

Affected Products

1E Client

References · 13

• https://bdu.fstec.ru/vul/2025-07417 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1683 · Security Note
• https://t.me/cveNotify/150421 · Telegram Post
• https://teamviewer.com/en/resources/trust-center/security-bulletins/1e-2025-2001 · Note
• https://capec.mitre.org/data/definitions/27.html · Note
• https://1e.com/trust-security-compliance/cve-info · Note
• https://cwe.mitre.org/data/definitions/59.html · Note
• https://twitter.com/CVEnew/status/1899894906145169733 · Twitter Post
• https://t.me/cvenotify/114575 · Telegram Post
• https://1e.com/trust-security-compliance/?ac=0-4 · Note
• https://t.me/latest_high_impact_cve/1954 · Telegram Post
• https://t.me/cvetracker/18987 · Telegram Post