PT-2025-31114 · Unknown · User Registry

Lukasz Piotrowski + 1 · Published 2025-07-28 · Updated 2025-08-04 · CVE-2025-2297

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Versions prior to 25.4.270.0

Description A local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.

Recommendations Update to version 25.4.270.0 or later.

Fix

LPE

Weakness Enumeration

CWE-268

Related Identifiers

CVE-2025-2297

Affected Products

User Registry

References · 8

• https://osv.dev/vulnerability/CVE-2025-2297 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2297 · Security Note
• https://beyondtrust.com/trust-center/security-advisories/bt25-05 · Vendor Advisory
• https://t.me/CVEtracker/28583 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1950350203799699581 · Twitter Post
• https://twitter.com/PaxionCyber/status/1950564824418488681 · Twitter Post
• https://t.me/cveNotify/130749 · Telegram Post
• https://twitter.com/CVEnew/status/1949862268251836916 · Twitter Post