PT-2025-42882 · Unknown · Workexaminer Professional

Published 2025-10-21 · Updated 2025-10-26 · CVE-2025-10641

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions WorkExaminer Professional (affected versions not specified)

Description Communication within WorkExaminer Professional lacks encryption, exposing sensitive data transmitted between monitoring clients, the console, and the server to potential interception and modification by network attackers. Monitoring clients utilize unencrypted FTP to send data to the server on port 12304. Furthermore, traffic between the console client and the server on port 12306 is also unencrypted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2025-10641

Affected Products

Workexaminer Professional

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-10641 · Security Note
• https://t.me/CVEtracker/35392 · Telegram Post
• http://seclists.org/fulldisclosure/2025/Oct/19 · Note
• https://r.sec-consult.com/workexaminer · Note
• https://twitter.com/cracbot/status/1982401881898143780 · Twitter Post