CVE-2025-0781 HIGH

CVE-2025-0781: Incorrect Authorization in SimGear

Vendor Flightgear

Product SimGear

Weakness CWE-863 · Incorrect authorization

Published January 28, 2025

Last update February 12, 2025

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system level.

Key dates

02Disclosure timeline

January 28, 2025 CVE published

February 12, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-0781

Related vulnerabilities

04Related CVE

CVE-2023-38368 IBM Security Access Manager Docker information disclosure CVE-2026-41689 Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal services CVE-2025-3227 Unauthorized channel member management through playbook runs CVE-2023-29296 [Cloud] Customer suspects IDOR vulnerability CVE-2025-7773 Rockwell Automation ArmorBlock 5000 I/O – Web Server Vulnerabilities