CVE-2025-31144

MediumCVSS 6.9/10Last modified Jun 17, 2026

Description

Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, a remote unauthenticated attacker may attempt to log in to an arbitrary host via Windows system where the product is running.

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-923

Affected software

VendorProductVersions
SIOS Technology, Inc.Quick Agent V3prior to Ver3.2.1
SIOS Technology, Inc.Quick Agent V2prior to Ver2.9.8

References

Timeline

Published
Apr 28, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-311466.1Time-of-check time-of-use race condition for some Intel Ethernet Adapter Complete Driver Pack software before version 1.5.1.0 within Ring 3:CVE-2025-311475.3Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.CVE-2025-31159.8Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. AdditCVE-2025-31166.5CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends specialCVE-2025-311602.9atop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecifCVE-2025-311619.8CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instaCVE-2025-311626.6Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via get_slope functionCVE-2025-311636.6Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via put_patternarc function.CVE-2025-311646.6heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via  create_line_with_spliCVE-2025-311656.9Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JaCVE-2025-31175.4CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting configuration fiCVE-2025-311709.1Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity