ZDI-CAN-25295: ZDI-25-183: (0Day) Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
First published: Tue Mar 25 2025(Updated: )
This vulnerability allows local attackers to escalate privileges on affected installations of Bdrive NetDrive. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bdrive NetDrive | ||
| Bdrive NetDrive |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-CAN-25295?
The severity of ZDI-CAN-25295 is classified as critical due to its potential for local privilege escalation.
How do I fix ZDI-CAN-25295?
To fix ZDI-CAN-25295, install the latest security updates provided by Bdrive for NetDrive.
Who is affected by ZDI-CAN-25295?
ZDI-CAN-25295 affects installations of Bdrive NetDrive where local attackers can exploit the vulnerability.
What type of attacks can ZDI-CAN-25295 facilitate?
ZDI-CAN-25295 can facilitate local privilege escalation attacks if exploited successfully.
What are the prerequisites for exploiting ZDI-CAN-25295?
An attacker must first obtain the ability to execute low-privileged code on the target system to exploit ZDI-CAN-25295.
- collector/zdi-published
- source/ZDI
- alias/ZDI-CAN-25295
- agent/source
- agent/title
- agent/last-modified-date
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- collector/zdi-advisory
- alias/ZDI-25-183
- alias/CVE-2025-2769
- agent/references
- agent/severity
- agent/softwarecombine
- agent/description
- agent/tags
- agent/event
- vendor/bdrive
- canonical/bdrive netdrive