Cyber Posture

CVE-2025-25598

High

Published: 13 March 2025

Published
13 March 2025
Modified
03 April 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0009 25.0th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.

Security Summary

CVE-2025-25598, published on 2025-03-13, is an incorrect access control vulnerability (CWE-284) in the scheduled tasks console of Inova Logic CUSTOMER MONITOR (CM) version 3.1.757.1. The flaw allows attackers to escalate privileges by placing a crafted executable into a scheduled task. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high severity due to its potential for significant impact across confidentiality, integrity, and availability.

Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L) and without requiring user interaction (UI:N). By leveraging the flawed access controls in the scheduled tasks console, they can insert a malicious executable that executes with elevated privileges upon scheduling, enabling privilege escalation and potentially full system compromise.

Mitigation details are available in the referenced advisory at https://github.com/quriusfox/vulnerability-research/tree/main/CVE-2025-25598.

Details

CWE(s)
CWE-284

Affected Products

inovalogic
customer monitor
3.1.757.1

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1053.005 Scheduled Task Execution
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.
Why these techniques?

Incorrect access control in the scheduled tasks console enables privilege escalation by placing crafted executables into scheduled tasks (T1068) and facilitates abuse of scheduled tasks for execution/persistence (T1053.005).

References