PT-2025-20661 · Hainan · Hainan Todesk

Ba1_Ma0

·

Published

2025-05-11

·

Updated

2025-05-16

·

CVE-2025-4539

CVSS v4.0

7.3

High

VectorAV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions Hainan ToDesk version 4.7.6.3
Description A critical vulnerability was found in Hainan ToDesk, affecting unknown code in the library profapi.dll of the component DLL File Parser. The manipulation leads to an uncontrolled search path, making it possible to launch an attack on the local host. The complexity of the attack is rather high, and the exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond.
Recommendations As a temporary workaround, consider restricting access to the vulnerable profapi.dll library until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Untrusted Search Path

Uncontrolled Search Path Element

Weakness Enumeration

CWE-426CWE-427

Related Identifiers

CVE-2025-4539

Affected Products

Hainan Todesk