PT-2026-4756 · Webui · Webui

Published 2026-01-26 · Updated 2026-01-31 · CVE-2025-59106

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions (affected versions not specified)

Description The binary responsible for serving the web server and executing actions initiated from the Web UI operates with root privileges, violating the principle of least privilege. Successful code execution on the system through other means could allow an attacker to directly execute commands with the highest level of privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Weakness Enumeration

CWE-272

Related Identifiers

CVE-2025-59106

Affected Products

Webui

References · 11

• https://dormakabagroup.com/en/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59106 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59106 · Vendor Advisory
• https://t.me/CVEtracker/43008 · Telegram Post
• https://twitter.com/cracbot/status/2017553498901254231 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2015744216496779634 · Twitter Post
• https://twitter.com/CVEnew/status/2015733298199474565 · Twitter Post
• https://twitter.com/TheHackerWire/status/2016267771383054554 · Twitter Post
• https://r.sec-consult.com/dormakaba · Note
• https://twitter.com/cracbot/status/2017191120141480138 · Twitter Post
• https://r.sec-consult.com/dkaccess · Note