CVE-2025-30075
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-09-17
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| alludo | mindmanager | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-673 | The product does not prevent the definition of control spheres from external actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a DLL Hijacking issue in Alludo MindManager on Windows versions before 25.0.208. It allows an attacker who can write DLL files to directories in the victim's DLL search path to execute arbitrary code with the privileges of other local users on the same machine. Essentially, if an attacker can place malicious DLL files in certain folders, they can trick the software into running their code. [1]
How can this vulnerability impact me? :
The vulnerability can allow an attacker with local access to execute malicious code under the context of other local users on the same machine. This could lead to unauthorized actions being performed with the privileges of those users, potentially compromising the system or data accessible to them. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update MindManager on Windows to version 25.0.208 or later. Additionally, restrict write permissions to directories within the DLL search paths to prevent unauthorized DLL file creation or modification by local users. [1]