StrongDM sdm-cli up to 47.96.0 cleartext transmission

Summaryinfo

A vulnerability classified as problematic has been found in StrongDM sdm-cli up to 47.96.0. This vulnerability affects unknown code. This manipulation causes cleartext transmission. This vulnerability is handled as CVE-2025-6180. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic was found in StrongDM sdm-cli up to 47.96.0. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a cleartext transmission vulnerability. The CWE definition for the vulnerability is CWE-319. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. As an impact it is known to affect confidentiality. The summary by CVE is:

The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, potentially redeeming valid authentication credentials through a race condition.

It is possible to read the advisory at security.strongdm.com. This vulnerability is known as CVE-2025-6180 since 06/16/2025. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1040 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-25352). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• StrongDM

Name

• sdm-cli

Version

• 47.0
• 47.1
• 47.2
• 47.3
• 47.4
• 47.5
• 47.6
• 47.7
• 47.8
• 47.9
• 47.10
• 47.11
• 47.12
• 47.13
• 47.14
• 47.15
• 47.16
• 47.17
• 47.18
• 47.19
• 47.20
• 47.21
• 47.22
• 47.23
• 47.24
• 47.25
• 47.26
• 47.27
• 47.28
• 47.29
• 47.30
• 47.31
• 47.32
• 47.33
• 47.34
• 47.35
• 47.36
• 47.37
• 47.38
• 47.39
• 47.40
• 47.41
• 47.42
• 47.43
• 47.44
• 47.45
• 47.46
• 47.47
• 47.48
• 47.49
• 47.50
• 47.51
• 47.52
• 47.53
• 47.54
• 47.55
• 47.56
• 47.57
• 47.58
• 47.59
• 47.60
• 47.61
• 47.62
• 47.63
• 47.64
• 47.65
• 47.66
• 47.67
• 47.68
• 47.69
• 47.70
• 47.71
• 47.72
• 47.73
• 47.74
• 47.75
• 47.76
• 47.77
• 47.78
• 47.79
• 47.80
• 47.81
• 47.82
• 47.83
• 47.84
• 47.85
• 47.86
• 47.87
• 47.88
• 47.89
• 47.90
• 47.91
• 47.92
• 47.93
• 47.94
• 47.95
• 47.96.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion