{"id":"CVE-2025-2297","state":"PUBLISHED","title":"Privilege Management for Windows - Elevation of Privilege","description":"Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.","publishedAt":"2025-07-28T15:40:14.633Z","updatedAt":"2025-07-28T17:22:18.590Z","severity":{"score":7.2,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"BT"},"assigner":"BT","products":["BeyondTrust Privilege Management for Windows"],"affected":[{"vendor":"BeyondTrust","product":"Privilege Management for Windows","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"<25.4.270","versionType":"cpe"}]}],"references":["https://www.beyondtrust.com/trust-center/security-advisories/bt25-05"],"weaknesses":["CWE-268"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/2xxx/CVE-2025-2297.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-2297","state":"PUBLISHED","datePublished":"2025-07-28T15:40:14.633Z","dateUpdated":"2025-07-28T17:22:18.590Z","assignerShortName":"BT","assignerOrgId":"13061848-ea10-403d-bd75-c83a022c2891","dateReserved":"2025-03-13T21:22:29.654Z"},"containers":{"cna":{"title":"Privilege Management for Windows - Elevation of Privilege","descriptions":[{"lang":"en","value":"Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator."}],"affected":[{"vendor":"BeyondTrust","product":"Privilege Management for Windows","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"<25.4.270","versionType":"cpe"}]}],"references":[{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt25-05"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":7.2,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-268","description":"CWE-268","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"BT","orgId":"13061848-ea10-403d-bd75-c83a022c2891","dateUpdated":"2025-07-28T15:40:14.633Z"},"credits":[{"lang":"en","type":"reporter","value":"Lukasz Piotrowski"},{"lang":"en","type":"reporter","value":"Marius Kotlarz"}],"impacts":[{"capecId":"CAPEC-233","descriptions":[{"lang":"en","value":"CAPEC-233 Privilege Escalation"}]}],"source":{"advisory":"BT25-05","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-28T17:22:05.722414Z","id":"CVE-2025-2297","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-28T17:22:18.590Z"}}]}}}