PT-2025-49864 · Algosec · Algosec Firewall Analyzer

Charlie Lindholm · Published 2025-12-09 · Updated 2025-12-17 · CVE-2025-12381

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AlgoSec Firewall Analyzer versions A33.0 through A33.10

Description A flaw exists in AlgoSec Firewall Analyzer that could allow a local user with command line access to elevate their privileges. This is due to improper handling of parameters within a command authorized in the sudoers file, potentially leading to privilege escalation and parameter injection.

Recommendations Apply updates to versions beyond A33.10. As a temporary workaround, restrict access to the sudoers file to authorized personnel only. Review and minimize the parameters allowed within commands configured in the sudoers file.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-12381

Affected Products

Algosec Firewall Analyzer

References · 5

• https://techdocs.algosec.com/en/cves/Content/tech-notes/cves/cve-2025-12381.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12381 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12381 · Vendor Advisory
• https://t.me/cveNotify/146086 · Telegram Post
• https://twitter.com/CVEnew/status/2000617605137117221 · Twitter Post