CVE-2025-25266

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application does not properly restrict access to the file deletion functionality. This could allow an unauthorized attacker to delete files even when access to the system should be prohibited, resulting in potential data loss or unauthorized modification of system files.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-552

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-252675.5A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All CVE-2025-252688.8An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write ac CVE-2025-252698.4An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.CVE-2025-25274.3Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows a CVE-2025-252709.8An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurat CVE-2025-252718.8An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.CVE-2025-252737.8Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow a CVE-2025-252748.8Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allo CVE-2025-252766.5An unauthenticated attacker can hijack other users' devices and potentially control them.CVE-2025-252777.0in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible ty CVE-2025-252787.0in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.CVE-2025-252797.5Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when impor