CVE-2025-66446
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| maxkb | maxkb | to 2.4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in MaxKB versions 2.3.1 and below involves improper file permissions that allow attackers to overwrite the built-in dynamic linker and other critical files. This can lead to privilege escalation, meaning an attacker could gain higher-level access than intended.
How can this vulnerability impact me? :
The vulnerability can allow attackers to escalate their privileges on the affected system, potentially gaining unauthorized control or access to sensitive functions and data, which can compromise system security and integrity.
What immediate steps should I take to mitigate this vulnerability?
Upgrade MaxKB to version 2.4.0 or later, as this version fixes the improper file permissions issue that allows privilege escalation.