Server-Side Authentication Bypass in WorkExaminer Professional Console by WorkExaminer

CVE-2025-10640

What is CVE-2025-10640?

An unauthenticated attacker can exploit a security flaw in the WorkExaminer Professional console, where critical server-side authentication checks are absent. By targeting TCP port 12306, an attacker can bypass the required login prompt and gain unauthorized administrative access. This vulnerability exposes sensitive monitoring data, including screenshots and keystroke logs of users, jeopardizing privacy and information security. The underlying issue stems from improper validation of authentication procedures, which are only checked on the client side.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References