PT-2025-23124 · Unknown · Absolute Secure Access

Published 2025-05-28 · Updated 2025-05-29 · CVE-2025-27703

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Absolute Secure Access versions prior to 13.54

Description The issue is a privilege escalation vulnerability in the management console. Attackers with administrative access to a specific subset of privileged features in the console can elevate their permissions to access additional features. The attack complexity is low, with no preexisting attack requirements, and the privileges required are high, with no user interaction required. The impact to system confidentiality is low, the impact to system integrity is high, and the impact to system availability is low.

Recommendations For versions prior to 13.54, update to version 13.54 or later to resolve the issue. As a temporary workaround, consider restricting access to the management console to minimize the risk of exploitation.

Fix

LPE

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2025-27703

Affected Products

Absolute Secure Access

References · 8

• https://absolute.com/platform/vulnerability-archive/cve-2025-27703 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27703 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27703 · Vendor Advisory
• https://twitter.com/cybercronai/status/1927916621827285343 · Twitter Post
• https://t.me/cvenotify/123939 · Telegram Post
• https://t.me/cvetracker/24867 · Telegram Post
• https://twitter.com/CVEnew/status/1927836019241386469 · Twitter Post
• https://twitter.com/offseq/status/1927877611125985375 · Twitter Post