PT-2025-23802 · Microsoft · Mim Admin Service

Published 2025-06-04 · Updated 2025-06-06 · CVE-2025-1701

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MIM Admin Service versions prior to 7.2.13 MIM Admin Service versions prior to 7.3.8 MIM Admin Service versions prior to 7.4.3

Description This issue allows an attacker to execute arbitrary code with the privileges of the MIM Admin service by sending a specially crafted request over the RMI interface. The RMI interface is only accessible locally, limiting the attack vector to the local machine. In a properly configured environment, an attacker must have already compromised the network and the system where the MIM Admin service is running to exploit this issue. Attackers with sufficient knowledge and access to extend the MIM RMI library could force the MIM Admin service to run commands on the local machine with its privileges.

Recommendations For versions prior to 7.2.13, update to version 7.2.13 or later. For versions prior to 7.3.8, update to version 7.3.8 or later. For versions prior to 7.4.3, update to version 7.4.3 or later. As a temporary workaround, consider restricting access to the RMI interface to minimize the risk of exploitation.

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

CWE-20

Related Identifiers

CVE-2025-1701

Affected Products

Mim Admin Service

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-1701 · Security Note
• https://mimsoftware.com/cve-2025-1701 · Note
• https://twitter.com/CVEnew/status/1930260124951531912 · Twitter Post
• https://t.me/cvetracker/25400 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1930800199695523963 · Twitter Post
• https://twitter.com/CveFindCom/status/1930258277666849118 · Twitter Post