CVE-2025-50691
Last modified
CVE-2025-50691 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. MCSManager 10.5.3 daemon process runs as a root account by default, and its sensitive data (including tokens and terminal content) is stored in the data directory, readable by all users. Other users on the system can read the daemon's key and use it to log in, leading to privilege escalation.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
MCSManager 10.5.3 daemon process runs as a root account by default, and its sensitive data (including tokens and terminal content) is stored in the data directory, readable by all users. Other users on the system can read the daemon's key and use it to log in, leading to privilege escalation.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-50691?
How severe is CVE-2025-50691?
How do I fix CVE-2025-50691?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-50675GPMAW 14, a bioinformatics software, has a critical vulnerab…7.8
- CVE-2025-5068Use after free in Blink in Google Chrome prior to 137.0.7151…8.8
- CVE-2025-50681igmpproxy 0.4 before commit 2b30c36 allows remote attackers …7.5
- CVE-2025-50688A command injection vulnerability exists in TwistedWeb (vers…6.5
- CVE-2025-5069An issue has been discovered in GitLab CE/EE affecting all v…6.5
- CVE-2025-50690A Cross-Site Scripting (XSS) vulnerability exists in Spatial…6.1
- CVE-2025-50692FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/tem…9.8
- CVE-2025-50693PHPGurukul Online DJ Booking Management System 2.0 is vulner…6.5
- CVE-2025-50695PHPGurukul Online DJ Booking Management System 2.0 is vulner…6.1
- CVE-2025-50699PHPGurukul Online DJ Booking Management System 2.0 is vulner…6.1
- CVE-2025-50706An issue in thinkphp v.5.1 allows a remote attacker to execu…9.8
- CVE-2025-50707An issue in thinkphp3 v.3.2.5 allows a remote attacker to ex…9.8
Are you affected by CVE-2025-50691?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST