PT-2025-17433 · Unknown · Soffid Console

Published 2025-04-21 · Updated 2025-04-21 · CVE-2025-32408

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Soffid Console versions 3.5.38 through 3.5.38 Soffid Console versions 3.6.31 through 3.6.31

Description The issue is related to the mishandling of authorization to use the pam service in Soffid Console. Additionally, necessary checks were not applied to some Java objects, which could allow a malicious agent to execute arbitrary code in the Sync Server and compromise security.

Recommendations For Soffid Console version 3.5.38, update to version 3.5.39 to resolve the issue. For Soffid Console version 3.6.31, update to version 3.6.32 to resolve the issue.

Fix

RCE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-32408

Affected Products

Soffid Console

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-32408 · Security Note
• https://twitter.com/WolfgangSesin/status/1914312985398378919 · Twitter Post
• https://t.me/cvedetector/23436 · Telegram Post
• https://bookstack.soffid.com/books/security-advisories/page/cve-2024-39669 · Note
• https://t.me/latest_high_impact_cve/2178 · Telegram Post
• https://bookstack.soffid.com/books/security-advisories/page/cve-2025-32408 · Note
• https://twitter.com/cybercronai/status/1914382512119235045 · Twitter Post
• https://twitter.com/CVEnew/status/1914303867547758927 · Twitter Post
• https://twitter.com/cybercronai/status/1914329671237325002 · Twitter Post
• https://t.me/cvetracker/22045 · Telegram Post