VulnSocial

CVE-2025-1415Disclosure

LOWCVSS 5.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM (Mobile Device Management), as well as details of the devices like their UUIDs needed for exploitation of CVE-2025-1416. In order to perform the attack, one has to know a task_id, but since it's a low integer and there is no limit of requests an attacker can perform to a vulnerable endpoint, the task_id might be simply brute forced. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-22: 104-22
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • afine@afinePL
    Disclosure

    Our researcher logged into an MDM console as a user with zero UI permissions and walked out with developer access to every managed phone in the fleet. Two GETs. CVE-2025-1415 + CVE-2025-1416 in Proget MDM. https://afine.com/blogs/broken-access-control-in-the-real-world-chaining-two-bugs-to-extract-mdm-service-passwords

    Post summary

    A researcher exposed two CVEs (2025‑1415 and 2025‑1416) in Proget MDM by chaining two GET requests to gain developer-level access, as detailed in a blog post, but no public exploit, patch, or active wild‑exploitation claim is provided.

    00000233
    123 followersView on X

Explore more

Back to dashboard