ByteOS Network

NVD Vulnerability Details :

CVE-2025-2297

Analyzed

Source-13061848-ea10-403d-bd75-c83a022c2891

Published At-28 Jul, 2025 | 16:15

Updated At-04 Aug, 2025 | 13:46

Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	7.2	HIGH	CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CPE Matches

BeyondTrust Corporation

>>privilege_management_for_windows>>Versions before 25.4.270(exclusive)

cpe:2.3:a:beyondtrust:privilege_management_for_windows:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-268	Secondary	13061848-ea10-403d-bd75-c83a022c2891

References

Hyperlink	Source	Resource
https://www.beyondtrust.com/trust-center/security-advisories/bt25-05	13061848-ea10-403d-bd75-c83a022c2891	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History