CVE-2025-25011
BaseFortify
Publication date: 2025-07-30
Last updated on: 2025-07-31
Assigner: Elastic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elastic | beats | 9.0.3 |
| elastic | beats | 9.0.0 |
| elastic | beats | 8.19.0 |
| elastic | beats | 9.0.5 |
| elastic | beats | 9.0.4 |
| elastic | beats | 9.1.0 |
| elastic | beats | 8.19.2 |
| elastic | beats | 9.0.1 |
| elastic | beats | 9.0.2 |
| elastic | beats | 8.18.5 |
| elastic | beats | 8.19.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-427 | The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an uncontrolled search path element issue caused by insecure directory permissions. It allows an attacker with local access to exploit improper handling of directory permissions to move or delete arbitrary files. This can lead to local privilege escalation, potentially allowing the attacker to gain SYSTEM-level privileges on the affected system.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with local access to escalate their privileges to SYSTEM level by moving or deleting arbitrary files. This can compromise the security and integrity of the affected system, potentially allowing the attacker to execute malicious actions with the highest privileges.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves insecure directory permissions that allow local privilege escalation. To detect it, you should check the permissions of directories related to the Beats Windows Installer prior to version 9.1.0. On Windows systems, you can use commands like 'icacls <directory_path>' to inspect directory permissions and identify if they are improperly set, allowing unauthorized modification or deletion of files. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the Beats Windows Installer to version 9.1.0 or later, where this vulnerability is resolved. Additionally, review and correct directory permissions to ensure they are not overly permissive, preventing unauthorized local users from moving or deleting files. [1]