CVE-2025-0556: fallo de gravedad alta en Progress Software Telerik Report Server
Telerik Report Server Clear Text Transmission of Agent Commands
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.3%
In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent process and app host process occurs over an unencrypted tunnel, which can be subjected to local network traffic sniffing.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Progress Software · Telerik Report ServerCVEs relacionadas — Progress Software Telerik Report Server
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-4357MEDIUMXML External Entity Processing Information DisclosureEPSS 0.7%CVE-2024-4837MEDIUMTrust Boundary Violation VulnerabilityEPSS 0.4%CVE-2026-106155HIGHStored Cross-site Scripting (XSS) in Telerik Report Server Web Report ViewersEPSS 0.2%CVE-2026-106145HIGHPrivilege Escalation in Telerik Report Server Service-Agent HubEPSS 0.1%