CVE-2025-34078

Katalog CVE

CVSS 7.8 · High EPSS 0,71%

Kerentanan Insufficiently Protected Credentials pada nsclient++. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file (nsclient.ini) stores the administrative password in plaintext and is readable by local users. By extracting this password, an attacker can authenticate to the NSClient++ web interface (typically accessible on port 8443) and abuse the ExternalScripts plugin to inject and execute arbitrary commands as SYSTEM by registering a custom script, saving the configuration, and triggering it via the API. This behavior is documented but insecure, as the plaintext credential exposure undermines access isolation between local users and administrative functions.

Rincian

Terbit di NVD

2 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/local/nscp_pe.rb exploit · advisory pihak ketiga
• https://vulncheck.com/advisories/nsclient-localtoremote-system-compromise exploit · advisory pihak ketiga
• https://www.exploit-db.com/exploits/46802 exploit · advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/48360 exploit · vdb entry