PT-2025-13240 · Kingsoft · Wps Office

Published 2025-03-27 · Updated 2025-03-27 · CVE-2025-2516

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Critical

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Amber

Name of the Vulnerable Software and Affected Versions WPS Office (Kingsoft) versions (affected versions not specified)

Description The issue involves the use of a weak cryptographic key pair in the signature verification process, allowing an attacker who successfully recovered the private key to sign components. Additionally, older versions of the software did not validate the update server's certificate, making them vulnerable to Adversary-In-The-Middle attacks, which could result in updates being hijacked.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2025-2516

Affected Products

Wps Office

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-2516 · Security Note
• https://twitter.com/cybercronai/status/1905341755895034305 · Twitter Post
• https://twitter.com/CVEnew/status/1905300637824549373 · Twitter Post
• https://twitter.com/CveFindCom/status/1905274101498798225 · Twitter Post
• https://t.me/cvedetector/21303 · Telegram Post
• https://welivesecurity.com/en/eset-research/nspx30-sophisticated-aitm-enabled-implant-evolving-since-2005 · Note