PT-2025-34367 · Unknown · Mcsmanager

Bddjr · Published 2025-08-22 · Updated 2025-08-22 · CVE-2025-50691

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: MCSManager version 10.5.3

Description: The MCSManager daemon process runs with root privileges by default. Sensitive data, including tokens and terminal content, is stored in a data directory accessible to all users. This allows unauthorized users to read the daemon’s key and potentially log in, leading to privilege escalation.

Recommendations: Ensure the MCSManager daemon process does not run with root privileges. Restrict access to the data directory containing sensitive information to authorized users only.

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-50691

Affected Products

Mcsmanager

References · 6

• https://osv.dev/vulnerability/CVE-2025-50691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-50691 · Security Note
• https://github.com/MCSManager/MCSManager/pull/1596 · Note
• https://github.com/bddjr/bddjr/discussions/9 · Note
• https://twitter.com/CVEnew/status/1958895846738518359 · Twitter Post
• https://t.me/CVEtracker/30678 · Telegram Post