CVE-2025-11906: Privilege escalation via writable configuration files in Progress Flowmon
A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with access to the default flowmon system user account used for SSH access to potentially escalate privileges to root during service initialization.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11906?
CVE-2025-11906 is classified as having a medium severity due to its potential for privilege escalation.
How do I fix CVE-2025-11906?
To fix CVE-2025-11906, update your Progress Flowmon to version 12.5.6 or later, ensuring proper file permissions are set.
Who is affected by CVE-2025-11906?
CVE-2025-11906 affects users of Progress Flowmon versions prior to 12.5.6 that have default SSH user accounts.
What could an attacker do with CVE-2025-11906?
An attacker exploiting CVE-2025-11906 could escalate privileges to the root account on the affected system.
Is there a workaround for CVE-2025-11906?
A temporary workaround for CVE-2025-11906 involves manually adjusting file permissions to secure configuration files until the software can be updated.