QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-2297

Back to search

CVE-2025-2297

Published: Jul 28, 2025

Modified: Jul 28, 2025

PUBLISHED

Description

Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.

VendorProductVersions

BeyondTrust

Privilege Management for Windows

affected
0 - < <25.4.270

Weaknesses (CWE)

CWE-268

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now