CVE-2025-40672
Last modified
CVE-2025-40672 is a high-severity vulnerability rated 8.5/10 on the CVSS scale. A Privilege Escalation vulnerability has been found in Panloader component v3.24.0.0 by Espiral MS Group. This vulnerability allows any user to override the file panLoad.exe that will be executed by SYSTEM user via a programmed task. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
A Privilege Escalation vulnerability has been found in Panloader component v3.24.0.0 by Espiral MS Group. This vulnerability allows any user to override the file panLoad.exe that will be executed by SYSTEM user via a programmed task. This would allow an attacker to obtain administrator permissions to perform whatever activities he/she wants, shuch as accessing sensitive information, executing code remotely, and even causing a denial of service (DoS).
Metrics
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-40672?
How severe is CVE-2025-40672?
How do I fix CVE-2025-40672?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-40667Missing authorization vulnerability in TCMAN's GIM v11. This…6.5
- CVE-2025-40668Incorrect authorization vulnerability in TCMAN's GIM v11. Th…6.5
- CVE-2025-40669Incorrect authorization vulnerability in TCMAN's GIM v11. Th…6.5
- CVE-2025-4067A vulnerability classified as critical has been found in Scr…6.9
- CVE-2025-40670Incorrect authorization vulnerability in TCMAN's GIM v11. Th…8.8
- CVE-2025-40671SQL injection vulnerability in AES Multimedia's Gestnet v1.0…9.3
- CVE-2025-40673A Missing Authorization vulnerability has been found in Dino…5.3
- CVE-2025-40674Reflected Cross-Site Scripting (XSS) in osCommerce v4. This …5.1
- CVE-2025-40675A Reflected Cross-Site Scripting (XSS) vulnerability has bee…6.1
- CVE-2025-40676Insecure Direct Object Reference (IDOR) in Negotiator v3.15.…5.3
- CVE-2025-40677SQL injection vulnerability in Summar Software´s Portal del …8.7
- CVE-2025-40678Unrestricted upload vulnerability for dangerous file types o…5.3
Are you affected by CVE-2025-40672?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST