CVE-2025-0542

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Local privilege escalation due to incorrect assignment of privileges of temporary files in the update mechanism of G DATA Management Server. This vulnerability allows a local, unprivileged attacker to escalate privileges on affected installations by placing a crafted ZIP archive in a globally writable directory, which gets unpacked in the context of SYSTEM and results in arbitrary file write.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Jan 25, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-05437.8Local privilege escalation in G DATA Security Client due to incorrect assignment of privileges to directories. This vulnerability allows a l CVE-2025-05454.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tekrom Technology T-Soft E-Comm CVE-2025-05464.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Restriction of Rendered UI Layers or F CVE-2025-05474.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Bizmu allows C CVE-2025-05496.8An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.3 prior to 17.9.8, from 17.10 prior to 17.10.6, and fro CVE-2025-05544.0The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 CVE-2025-05556.1A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 pri CVE-2025-05566.5In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communicati CVE-2025-05574.3A vulnerability classified as problematic has been found in Hyland Alfresco Community Edition and Alfresco Enterprise Edition up to 6.2.2. T CVE-2025-05589.8A vulnerability classified as critical was found in TDuckCloud tduck-platform up to 4.0. This vulnerability affects the function QueryProThe CVE-2025-05594.8A vulnerability, which was classified as problematic, has been found in Campcodes School Management Software 1.0. This issue affects some un CVE-2025-05604.8A vulnerability, which was classified as problematic, was found in CampCodes School Management Software 1.0. Affected is an unknown function