CVE-2025-25711
Published: 12 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-25711 is a privilege escalation vulnerability in dtp.ae tNexus Airport View version 2.8. The issue allows a remote attacker to escalate privileges by manipulating the ProfileID value in requests to the /tnexus/rest/admin/updateUser API endpoint. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-281 (Improper Preservation of Permissions). The vulnerability was published on 2025-03-12.
The attack requires low privileges (PR:L) and can be carried out remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). An authenticated attacker with basic access can exploit the flawed API endpoint to elevate their privileges, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).
A related research repository is available at https://github.com/z5jt/vulnerability-research/tree/main/CVE-2025-25710, which may provide additional technical details.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes a privilege escalation vulnerability allowing an authenticated low-privileged user to elevate access by manipulating ProfileID in an API request, directly mapping to exploitation of a software vulnerability for privilege escalation.