Design Flaw in Manager Accounting Software Allows Unauthorized Access

CVE-2025-64180

What is CVE-2025-64180?

A significant design flaw in Manager accounting software allows unauthorized access to internal network resources. Specifically, in the Desktop and Server editions, versions 25.11.1.3085 and below, a critical vulnerability arises from the DNS validation mechanism. This leads to a Time-of-Check Time-of-Use (TOCTOU) condition, giving attackers the ability to bypass network isolation and access sensitive internal services, including cloud metadata endpoints and protected segments. The ease of exploitation is heightened, as the Desktop edition does not require any authentication, while the Server edition only mandates standard authentication. The flaw has been addressed in version 25.11.1.3086, making it crucial for users to upgrade to ensure the security of their systems.

References