CVE-2025-1416 HIGH

CVE-2025-1416: Password disclosure in Proget MDM

Vendor Proget
Product Proget
Weakness CWE-863 · Incorrect authorization
Published May 21, 2025
Last update May 21, 2025
View on NVD All CVEs

CVSS base score

7.0/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

What the vulnerability does

01Description

In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM (Mobile Device Management). For it to happen, they must know the UUIDs of targetted devices, which might be obtained by exploiting CVE-2025-1415 or CVE-2025-1417. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).

Key dates

02Disclosure timeline

May 21, 2025 CVE published
May 21, 2025 Record updated