PT-2025-31115 · Crowdstrike · Defendpoint

Published 2025-07-28 · Updated 2025-08-04 · CVE-2025-6250

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Symantec Defendpoint versions prior to 25.4.270.0

Description Prior to version 25.4.270.0, when wmic.exe is elevated with a full admin token, a user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, a malicious user can add themselves to the Administrators group and run any process with elevated permissions.

Recommendations Update Symantec Defendpoint to version 25.4.270.0 or later.

Fix

LPE

Weakness Enumeration

CWE-424

Related Identifiers

CVE-2025-6250

Affected Products

Defendpoint

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-6250 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6250 · Vendor Advisory
• https://beyondtrust.com/trust-center/security-advisories/bt25-06 · Vendor Advisory
• https://twitter.com/CVEnew/status/1949862267161387176 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1949934120672358625 · Twitter Post
• https://t.me/CVEtracker/28584 · Telegram Post
• https://t.me/cveNotify/130750 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1950350203799699581 · Twitter Post