CVE-2025-2449
Published: 18 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-2449 is a directory traversal vulnerability in the usiReg component of NI FlexLogger that enables remote code execution. The issue stems from insufficient validation of user-supplied paths during URI file parsing, allowing attackers to create arbitrary files on affected installations. Published on 2025-03-18, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and maps to CWE-22; it was previously tracked as ZDI-CAN-21805.
Remote attackers without privileges can exploit this vulnerability by luring a target user into visiting a malicious web page or opening a malicious file. User interaction is required, after which the attacker can leverage the path traversal to write files and execute arbitrary code in the context of the current user, potentially compromising confidentiality, integrity, and availability.
The Zero Day Initiative advisory (ZDI-25-146), available at https://www.zerodayinitiative.com/advisories/ZDI-25-146/, provides further details on the vulnerability.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Client-side RCE vulnerability in desktop application triggered by user opening malicious file or visiting malicious link, directly enabling T1203 exploitation for client execution and T1204 user execution.