CVE-2025-10640

{"id": "CVE-2025-10640", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10640", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-22T18:59:26.555996Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "affectedData": [{"vendor": "EfficientLab", "product": "WorkExaminer Professional", "versions": [{"status": "affected", "version": "<= 4.0.0.52001"}], "defaultStatus": "unknown"}]}], "published": "2025-10-21T12:15:35.420", "references": [{"url": "https://r.sec-consult.com/workexaminer", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "http://seclists.org/fulldisclosure/2025/Oct/19", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-602"}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks to bypass the login prompt in the WorkExaminer Professional console to gain administrative access to the WorkExaminer server and therefore all sensitive monitoring data. This includes monitored screenshots and keystrokes of all users.\n\nThe WorkExaminer Professional console is used for administrative access to the server. Before access to the console is granted administrators must login. Internally, a custom protocol is used to call a respective stored procedure on the MSSQL database. The return value of the call is not validated on the server-side. Instead it is only validated client-side which allows to bypass authentication."}, {"lang": "es", "value": "Un atacante no autenticado con acceso al puerto TCP 12306 del servidor WorkExaminer puede explotar la falta de comprobaciones de autenticaci\u00f3n del lado del servidor para eludir la solicitud de inicio de sesi\u00f3n en la consola WorkExaminer Professional y obtener acceso administrativo al servidor WorkExaminer y, por lo tanto, a todos los datos de monitoreo sensibles. Esto incluye capturas de pantalla y pulsaciones de teclas monitoreadas de todos los usuarios.\n\nLa consola WorkExaminer Professional se utiliza para el acceso administrativo al servidor. Antes de que se conceda el acceso a la consola, los administradores deben iniciar sesi\u00f3n. Internamente, se utiliza un protocolo personalizado para llamar a un procedimiento almacenado respectivo en la base de datos MSSQL. El valor de retorno de la llamada no se valida en el lado del servidor. En su lugar, solo se valida en el lado del cliente, lo que permite eludir la autenticaci\u00f3n."}], "lastModified": "2026-10-08T11:10:00.250", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}