PT-2025-33074 · Nomachine · Nomachine

Xavier Dane · Published 2025-08-13 · Updated 2025-09-03 · CVE-2025-8614

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NoMachine (affected versions not specified)

Description This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this issue. The flaw exists within the configuration of OpenSSL, where the product loads an OpenSSL configuration file from an unsecured location. This can allow an attacker to escalate privileges and execute arbitrary code in the context of the service account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-8614

ZDI-25-835

Affected Products

Nomachine

References · 6

• https://zerodayinitiative.com/advisories/ZDI-25-835 · Security Note
• https://kb.nomachine.com/TR04W11314 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-8614 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8614 · Security Note
• https://twitter.com/CVEnew/status/1962972922382831975 · Twitter Post
• https://t.me/CVEtracker/31514 · Telegram Post