Server-Side Authentication Bypass in WorkExaminer Professional Console by WorkExaminer

CVE-2025-10640

What is CVE-2025-10640?

An unauthenticated attacker can exploit a security flaw in the WorkExaminer Professional console, where critical server-side authentication checks are absent. By targeting TCP port 12306, an attacker can bypass the required login prompt and gain unauthorized administrative access. This vulnerability exposes sensitive monitoring data, including screenshots and keystroke logs of users, jeopardizing privacy and information security. The underlying issue stems from improper validation of authentication procedures, which are only checked on the client side.

References