CVE-2025-11906: falha de média gravidade em Progress Software Flowmon
Privilege escalation via writable configuration files in Progress Flowmon
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.7epss 0.1%
A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with access to the default flowmon system user account used for SSH access to potentially escalate privileges to root during service initialization.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Progress Software · FlowmonCVEs relacionadas — Progress Software Flowmon
No mesmo produto, das mais perigosas para as menos.
CVE-2024-2389CRITICALFlowmon Unauthenticated Command Injection VulnerabilityEPSS 93.0%CVE-2026-3692HIGHUnintended command execution during report generation in Progress FlowmonEPSS 0.4%CVE-2025-10239HIGHUnintended command execution via troubleshooting scripts in Progress FlowmonEPSS 0.4%CVE-2026-8079HIGHUnintended limited set of actions with elevated privileges may be performed during PDF generation in Progress FlowmonEPSS 0.3%CVE-2025-10240HIGHPossibility of unintended actions when a user clicks a malicious link in the Progress Flowmon web applicationEPSS 0.3%CVE-2026-2737HIGHPossibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon web applicationEPSS 0.2%