VulnSocial

CVE-2025-6250(beyondtrust / privilege_management_for_windows)

LOWCVSS 6.7 · MEDIUM

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.

beyondtrust CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-424

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • privilege_management_for_windows

Affected systems

Vendors
beyondtrust
Products
privilege_management_for_windows

Deep dive

Full discourse1 post
  • Nothing@hadi_ynwl

    توی یکی از مواردی که بررسی کردیم یکی از سازمان‌هایی که از این طریق مورد نفوذ قرار گرفته بود، Redis 8.2.2 رو شاهدش بودیم که از اکسپلویت کردن CVE-2025-6250 (XACKDEL توی دستور Stack Buffer Overflow) استفاده شده بود و مستقیم توی RAM شل گرفته شده بود (echo <b64> | base64 -d | sh)./۲

    10010131
    547 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appbeyondtrustprivilege_management_for_windows---

Explore more

Back to dashboardbeyondtrust CVEsprivilege_management_for_windows vulnerabilities