VulnSocial

CVE-2025-1416Disclosure

LOWCVSS 7.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM (Mobile Device Management). For it to happen, they must know the UUIDs of targetted devices, which might be obtained by exploiting CVE-2025-1415 or CVE-2025-1417. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-22: 104-22
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • afine@afinePL
    Disclosure

    Our researcher logged into an MDM console as a user with zero UI permissions and walked out with developer access to every managed phone in the fleet. Two GETs. CVE-2025-1415 + CVE-2025-1416 in Proget MDM. https://afine.com/blogs/broken-access-control-in-the-real-world-chaining-two-bugs-to-extract-mdm-service-passwords

    Post summary

    A researcher disclosed that by chaining two CVEs (2025‑1415 and 2025‑1416) in Proget MDM, a zero‑UI user could gain developer access to all devices. No PoC code, patch, or detailed technical breakdown is provided.

    00000233
    123 followersView on X

Explore more

Back to dashboard