PT-2025-30662 · Microsoft+1 · Windows+1

Published 2025-07-24 · Updated 2025-07-24 · CVE-2025-40680

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions CapillaryScope version 2.5.0

Description The software lacks sensitive data encryption, storing proxy credentials and the JWT session token in plain text within Windows registry keys. Any authenticated local user with read access to the registry can extract these sensitive values.

Recommendations Apply appropriate encryption mechanisms to protect sensitive data stored in the Windows registry.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2025-40680

Affected Products

Capillaryscope

Windows

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-40680 · Security Note
• https://twitter.com/CVEnew/status/1948360737979564384 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/encryption-sensitive-data-capillaryscope-missing · Note