PT-2025-43416 · Mongodb · Mongodb Atlas Sql Odbc Driver

Published 2025-10-22 · Updated 2025-10-28 · CVE-2025-11575

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MongoDB Atlas SQL ODBC driver versions 1.0.0 through 2.0.0

Description An incorrect default permissions issue exists in the MongoDB Atlas SQL ODBC driver on Windows, potentially allowing for privilege escalation. The issue stems from improperly configured permissions during installation, specifically when using the MSI installer, which may result in Access Control Lists (ACLs) being unset on custom installation directories.

Recommendations Versions 1.0.0 through 2.0.0: Ensure permissions are correctly configured on custom installation directories to prevent unauthorized privilege escalation.

Fix

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2025-13337

CVE-2025-11575

Affected Products

Mongodb Atlas Sql Odbc Driver

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-11575 · Security Note
• https://bdu.fstec.ru/vul/2025-13337 · Security Note
• https://mongodb.com/docs/atlas/release-notes/sql · Note
• https://twitter.com/VulmonFeeds/status/1981238598654439832 · Twitter Post
• https://t.me/cveNotify/139965 · Telegram Post
• https://twitter.com/CveFindCom/status/1981158687482794200 · Twitter Post
• https://twitter.com/cracbot/status/1983126633663082509 · Twitter Post
• https://t.me/CVEtracker/35533 · Telegram Post
• https://twitter.com/CVEnew/status/1981219890649330109 · Twitter Post