PT-2025-28508 · Microsoft · Configuration Manager

Kalimer0X00 + 1 · Published 2025-07-08 · Updated 2025-09-09 · CVE-2025-47178

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Configuration Manager (affected versions not specified)

Description The vulnerability in Microsoft Configuration Manager stems from improper neutralization of special elements used in SQL commands, leading to a potential SQL injection issue. Exploitation could allow an authorized attacker to execute code on an adjacent network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-08479

CVE-2025-47178

Affected Products

Configuration Manager

References · 19

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47178 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47178 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47178 · Security Note
• https://bdu.fstec.ru/vul/2025-08479 · Security Note
• https://twitter.com/PrajwalDesai/status/1965388497927504183 · Twitter Post
• https://learn.microsoft.com/en-us/intune/configmgr/hotfix · Note
• https://reddit.com/r/CVEWatch/comments/1ncev9w/top_10_trending_cves_09092025 · Reddit Post
• https://t.me/cveNotify/130031 · Telegram Post
• https://twitter.com/Mirolus_LLC/status/1943762501876805721 · Twitter Post
• https://twitter.com/TylerJones23308/status/1950900862022242565 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47178 · Note
• https://twitter.com/MMelkersen/status/1965074655204798653 · Twitter Post
• https://twitter.com/PrajwalDesai/status/1950900318470119571 · Twitter Post
• https://reddit.com/r/SCCM/comments/1nc0lzq/kb34503790_revised_security_update_for_configmgr · Reddit Post
• https://twitter.com/PrajwalDesai/status/1943773189441826948 · Twitter Post