CVE-2025-25497: High severity Netsweeper Server vulnerability
An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Account Owner" field due to client-side-only restrictions and a lack of server-side validation. This vulnerability enables account ownership reassignment to or away from any user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netsweeper Serverto a version that resolves this vulnerability.Fixed in 8.2.7
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25497?
CVE-2025-25497 is considered a high severity vulnerability due to unauthorized account ownership reassignment.
How do I fix CVE-2025-25497?
To fix CVE-2025-25497, upgrade Netsweeper Server to version 8.2.7 or later.
What are the consequences of CVE-2025-25497 if exploited?
Exploitation of CVE-2025-25497 allows an attacker to change the 'Account Owner' field to gain unauthorized access to accounts.
Which versions of Netsweeper Server are affected by CVE-2025-25497?
Netsweeper Server versions 8.2.6 and earlier are affected by CVE-2025-25497.
Is there a workaround for CVE-2025-25497 before upgrading?
There is no known workaround for CVE-2025-25497; upgrading is the recommended solution.