PT-2025-42879 · Unknown · Workexaminer Professional

Published 2025-10-21 · Updated 2025-10-26 · CVE-2025-10639

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WorkExaminer Professional (affected versions not specified)

Description The WorkExaminer Professional server installation includes an FTP server listening on TCP port 12304 to receive client logs. An attacker with network access to this port can leverage weak, hardcoded credentials to log in to the FTP server. Successful authentication allows the attacker to modify or read data and log files. Remote code execution as NT AuthoritySYSTEM on the server is possible by exchanging accessible service binaries located in the WorkExaminer installation directory, such as "C:Program Files (x86)Work Examiner Professional Server".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-10639

Affected Products

Workexaminer Professional

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-10639 · Security Note
• https://t.me/CVEtracker/35390 · Telegram Post
• https://twitter.com/CVEnew/status/1980602707778932909 · Twitter Post
• https://twitter.com/cracbot/status/1982401878085579019 · Twitter Post
• http://seclists.org/fulldisclosure/2025/Oct/19 · Note
• https://r.sec-consult.com/workexaminer · Note