CVE-2025-31144

MediumCVSS 6.9/10Last modified Jun 17, 2026

Description

Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, a remote unauthenticated attacker may attempt to log in to an arbitrary host via Windows system where the product is running.

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-923

Affected software

No affected versions have been published.

Timeline

Published: Apr 28, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-311466.1Time-of-check time-of-use race condition for some Intel Ethernet Adapter Complete Driver Pack software before version 1.5.1.0 within Ring 3:CVE-2025-311475.3Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.CVE-2025-31159.8Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Addit CVE-2025-31166.5CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special CVE-2025-311602.9atop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecif CVE-2025-311619.8CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy insta CVE-2025-311626.6Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via get_slope function CVE-2025-311636.6Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via put_patternarc function.CVE-2025-311646.6heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spli CVE-2025-311656.9Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute Ja CVE-2025-31175.4CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting configuration fi CVE-2025-311709.1Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity