Unauthorized Account Ownership Changes in Netsweeper Server
CVE-2025-25497

8.1HIGH

Key Information:

Vendor

Netsweeper

Status
Netsweeper Server
Vendor
CVE Published:
6 March 2025

What is CVE-2025-25497?

A vulnerability exists in the account management interface of Netsweeper Server versions up to 8.2.6, permitting unauthorized modifications to the 'Account Owner' field. This issue arises from client-side-only restrictions coupled with inadequate server-side validation, allowing potential reassignment of account ownership to any user. The flaw has been addressed in version 8.2.7, reinforcing the importance of robust server-side checks to ensure secure account management.

References

https://packetstorm.news/files/id/188626/
https://helpdesk.netsweeper.com/docs/8_2_Docs/8_2_Netswee...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.