Cordaware bestinformed Infoclient up to 6.3.6.x on Windows external control of setting

Summaryinfo

A vulnerability was found in Cordaware bestinformed Infoclient up to 6.3.6.x on Windows and classified as critical. The affected element is an unknown function. Executing a manipulation can lead to external control of setting. The identification of this vulnerability is CVE-2025-0425. The attack can only be executed locally. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Cordaware bestinformed Infoclient up to 6.3.6.x on Windows and classified as critical. This vulnerability affects an unknown code. The manipulation with an unknown input leads to a external control of setting vulnerability. The CWE definition for the vulnerability is CWE-15. One or more system settings or configuration elements can be externally controlled by a user. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed Server" to which this client connects. This is dangerous as the "bestinformed Infoclient" runs with elevated permissions ("nt authority\system"). By changing the server address to a malicious server, or a script simulating a server, the user is able to escalate his privileges by abusing certain features of the "bestinformed Web" server. Those features include: * Pushing of malicious update packages * Arbitrary Registry Read as "nt authority\system" An attacker is able to escalate his privileges to "nt authority\system" on the Windows client running the "bestinformed Infoclient".  This attack is not possible if a custom configuration ("Infoclient.ini") containing the flags "ShowOnTaskbar=false" or "DisabledItems=stPort,stAddress" is deployed.

The weakness was shared by David Miller. The advisory is shared for download at cordaware.com. This vulnerability was named CVE-2025-0425 since 01/13/2025. The exploitation appears to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

Upgrading to version 6.3.7.0 eliminates this vulnerability. The upgrade is hosted for download at cordaware.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Cordaware

Name

• bestinformed Infoclient

Version

• 6.3.0
• 6.3.1
• 6.3.2
• 6.3.3
• 6.3.4
• 6.3.5
• 6.3.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion