{"id":"CVE-2025-10639","state":"PUBLISHED","title":"Usage of Hardcoded FTP Credentials EfficientLab WorkExaminer Professional","description":"The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain remote code execution as NT Authority\\SYSTEM on the server by exchanging accessible service binaries in the WorkExaminer installation directory (e.g. \"C:\\Program File (x86)\\Work Examiner Professional Server\").","publishedAt":"2025-10-21T11:36:10.097Z","updatedAt":"2025-11-03T17:31:34.424Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"SEC-VLab","products":["EfficientLab WorkExaminer Professional"],"affected":[{"vendor":"EfficientLab","product":"WorkExaminer Professional","defaultStatus":"unknown","versions":[{"version":"<= 4.0.0.52001","status":"affected"}]}],"references":["https://r.sec-consult.com/workexaminer","http://seclists.org/fulldisclosure/2025/Oct/19"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/10xxx/CVE-2025-10639.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-10639","state":"PUBLISHED","datePublished":"2025-10-21T11:36:10.097Z","dateUpdated":"2025-11-03T17:31:34.424Z","assignerShortName":"SEC-VLab","assignerOrgId":"551230f0-3615-47bd-b7cc-93e92e730bbf","dateReserved":"2025-09-17T14:05:15.138Z"},"containers":{"cna":{"title":"Usage of Hardcoded FTP Credentials EfficientLab WorkExaminer Professional","descriptions":[{"lang":"en","value":"The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain remote code execution as NT Authority\\SYSTEM on the server by exchanging accessible service binaries in the WorkExaminer installation directory (e.g. \"C:\\Program File (x86)\\Work Examiner Professional Server\")."}],"affected":[{"vendor":"EfficientLab","product":"WorkExaminer Professional","defaultStatus":"unknown","versions":[{"version":"<= 4.0.0.52001","status":"affected"}]}],"references":[{"url":"https://r.sec-consult.com/workexaminer","tags":["third-party-advisory"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","description":"CWE-798 Use of Hard-coded Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"SEC-VLab","orgId":"551230f0-3615-47bd-b7cc-93e92e730bbf","dateUpdated":"2025-10-21T11:36:10.097Z"},"credits":[{"lang":"en","type":"finder","value":"Tobias Niemann, SEC Consult Vulnerability Lab"},{"lang":"en","type":"finder","value":"Daniel Hirschberger, SEC Consult Vulnerability Lab"},{"lang":"en","type":"finder","value":"Thorger Jansen, SEC Consult Vulnerability Lab"},{"lang":"en","type":"finder","value":"Marius Renner, SEC Consult Vulnerability Lab"}],"impacts":[{"capecId":"CAPEC-642","descriptions":[{"lang":"en","value":"CAPEC-642 Replace Binaries"}]},{"capecId":"CAPEC-191","descriptions":[{"lang":"en","value":"CAPEC-191 Read Sensitive Constants Within an Executable"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The vendor responded to the submission of our security vulnerabilities by stating that they are not within the scope of their bug bounty program. After telling them that we do not care about the bug bounty but a fix for the issues, we did not receive any further response.<br><br>Hence, there is no fix available for the identified security issues and we assume that this product is unmaintained. We urge customers to contact EfficientLab regarding the issues and a potential solution, such as using another product.<br>"}],"value":"The vendor responded to the submission of our security vulnerabilities by stating that they are not within the scope of their bug bounty program. After telling them that we do not care about the bug bounty but a fix for the issues, we did not receive any further response.\n\nHence, there is no fix available for the identified security issues and we assume that this product is unmaintained. We urge customers to contact EfficientLab regarding the issues and a potential solution, such as using another product."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-10-22T19:01:35.557725Z","id":"CVE-2025-10639","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-22T19:01:38.597Z"}},{"title":"CVE Program Container","references":[{"url":"http://seclists.org/fulldisclosure/2025/Oct/19"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T17:31:34.424Z"}}]}}}