CVE-2025-2297

Summary

Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.

Affected Software

VendorProductVersion RangeStatus
BeyondTrustPrivilege Management for Windows0 < <25.4.270affected

Weaknesses

  • CWE-268: CWE-268

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References