PT-2025-44302 · Progress · Moveit Transfer

Published 2025-10-29 · Updated 2025-10-31 · CVE-2025-10932

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions Progress MOVEit Transfer versions 2023.1.0 through 2023.1.16 Progress MOVEit Transfer versions 2024.1.0 through 2024.1.7 Progress MOVEit Transfer versions 2025.0.0 through 2025.0.3

Description An uncontrolled resource consumption issue exists in the AS2 module of Progress MOVEit Transfer. This allows an attacker to potentially exhaust server resources, leading to a denial-of-service (DoS) condition. Approximately 474.5k devices are potentially affected worldwide. The issue involves crafted AS2 requests that can overwhelm servers and cause a DoS.

Recommendations Progress MOVEit Transfer versions 2023.1.0 through 2023.1.16 should be updated to a fixed version. Progress MOVEit Transfer versions 2024.1.0 through 2024.1.7 should be updated to a fixed version. Progress MOVEit Transfer versions 2025.0.0 through 2025.0.3 should be updated to a fixed version.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2025-13690

CVE-2025-10932

Affected Products

Moveit Transfer

References · 9

• https://bdu.fstec.ru/vul/2025-13690 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-10932 · Security Note
• https://twitter.com/Karma_X_Inc/status/1984243077515550885 · Twitter Post
• https://twitter.com/CveTodo/status/1983556649710182858 · Twitter Post
• https://twitter.com/CVEnew/status/1983545889852457429 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1983562772936888785 · Twitter Post
• https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-CVE-2025-10932-October-29-2025 · Note
• https://twitter.com/zoomeye_team/status/1984088934658527587 · Twitter Post
• https://t.me/pentestingnews/70347 · Telegram Post