CVE-2025-4636 HIGH

CVE-2025-4636: Local Privilege Escalation

Vendor Jct

Product Airpointer

Weakness CWE-269

Published May 30, 2025

Last update May 30, 2025

View on NVD All CVEs

CVSS base score

7.8/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Due to excessive privileges granted to the web user running the airpointer web platform, a malicious actor that gains control of the this user would be able to privilege escalate to the root user

Key dates

02Disclosure timeline

May 30, 2025 CVE published

May 30, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-4636 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/269.html

Related vulnerabilities

04Related CVE

CVE-2024-7960 Rockwell Automation Incorrect Privileges and Path Traversal Vulnerability in Pavilion8® CVE-2026-42562 Plainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control) CVE-2023-50267 MeterSphere horizontal privilege escalation vulnerability of resources in project scope. CVE-2024-4545 EDB Postgres Advanced Server (EPAS) authenticated file read permissions bypass using edbldr CVE-2022-1256 Improper Privilege Management in McAfee Agent for Windows