Cyber Posture

CVE-2025-25871

HighPublic PoC

Published: 14 March 2025

Published
14 March 2025
Modified
03 April 2025
KEV Added
Patch
CVSS Score 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0029 52.4th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-25871 is a privilege escalation vulnerability affecting Open Panel version 0.3.4. The flaw resides in the Fix Permissions function, which allows a remote attacker to elevate their privileges. Published on 2025-03-14, it carries a CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) and maps to CWE-281 (Improper Preservation of Permissions).

A remote attacker with low privileges can exploit the vulnerability over the network with low attack complexity, though it requires user interaction. Successful exploitation results in high impacts to confidentiality, integrity, and availability, specifically enabling privilege escalation.

The OpenPanel changelog for version 0.3.5 references security fixes addressing this issue, indicating that upgrading to 0.3.5 mitigates the vulnerability. Further details are provided in advisories hosted on PacketStorm.

Details

CWE(s)
CWE-281

Affected Products

openpanel
openpanel
0.3.4

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The CVE explicitly describes a remote privilege escalation vulnerability in the Fix Permissions function of a public-facing web control panel (Open Panel), directly enabling exploitation of public-facing applications (T1190) and exploitation for privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References