PT-2025-38068 · Microsoft+1 · Windows+3

Msry1 · Published 2025-09-16 · Updated 2025-09-20 · CVE-2025-57625

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CYRISMA Sensor versions prior to 444

Description CYRISMA Sensor before version 444 for Windows contains an insecure folder and file permissions issue. A low-privileged user can exploit this to escalate privileges and execute arbitrary code with NT AUTHORITYSYSTEM privileges. This is achieved by replacing DataSpotliteAgent.exe or other binaries called by the Cyrisma Agent service during startup.

Recommendations Update CYRISMA Sensor to version 444 or later. As a temporary workaround, restrict write access to the affected folder and files to prevent unauthorized modification of DataSpotliteAgent.exe and other binaries called by the Cyrisma Agent service.

Exploit

Fix

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-57625

Affected Products

Cyrisma Sensor

Cyrisma Agent

Dataspotliteagent.Exe

Windows

References · 6

• 🔥 https://msry1.gitbook.io/thegoldenrecord/blog/vulnerability-and-bug-disclosures/cyrsma-sensor-version-less-than-2.5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57625 · Security Note
• https://t.me/CVEtracker/32677 · Telegram Post
• https://twitter.com/CVEnew/status/1969291996947730847 · Twitter Post
• https://youtu.be/2DScqXPtrWw · Note
• https://twitter.com/VulmonFeeds/status/1968116755386995161 · Twitter Post