CVE-2025-25497

—

CVSS 3.1

8.1 high

EPSS

<1%p29

Published

Mar 6, 2025 (Mar 6, 2025)

Modified

Jun 17, 2026

Description

An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Account Owner" field due to client-side-only restrictions and a lack of server-side validation. This vulnerability enables account ownership reassignment to or away from any user.

Weakness: CWE-602
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.