PT-2025-21164 · Telerik · Telerik Ui For Ajax

Chudypb + 1 · Published 2025-05-14 · Updated 2026-02-19 · CVE-2025-3600

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Progress Telerik UI for AJAX versions 2011.2.712 through 2025.1.218

Description An unsafe reflection issue exists in Progress Telerik UI for AJAX. This flaw can lead to an unhandled exception, potentially causing a crash of the hosting process and resulting in a denial of service. Reports indicate that this issue affects millions of enterprise applications worldwide. Exploitation can be achieved with a single HTTP request, and in some cases, may lead to remote code execution when combined with other vulnerabilities. The vulnerability is related to unsafe reflection, a programming technique where an application uses runtime information to examine or modify its own structure and behavior.

Recommendations Update to a version beyond 2025.1.218. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-470

Related Identifiers

BDU:2026-00337

CVE-2025-3600

Affected Products

Telerik Ui For Ajax

References · 30

• https://telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-unsafe-reflection-cve-2025-3600 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00337 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-3600 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3600 · Vendor Advisory
• https://reddit.com/r/CVEWatch/comments/1o6670r/top_10_trending_cves_14102025 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1o4l7oe/top_10_trending_cves_12102025 · Reddit Post
• https://t.me/defcon_news/132253 · Telegram Post
• https://twitter.com/CVEnew/status/1922695640087396803 · Twitter Post
• https://twitter.com/CrowdCyber_Com/status/1977490555299909952 · Twitter Post
• https://t.me/cveNotify/133562 · Telegram Post
• https://twitter.com/Karma_X_Inc/status/1979991036077179020 · Twitter Post
• https://twitter.com/_r_netsec/status/1976655987525423486 · Twitter Post
• https://twitter.com/cyberkendra/status/1976673939540648102 · Twitter Post
• https://twitter.com/HackingTeam777/status/1977840286165586320 · Twitter Post
• https://twitter.com/cracbot/status/1924419855286972594 · Twitter Post