CVE-2025-9055

MediumCVSS 6.4/10Last modified Oct 18, 2026

Description

The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can only be exploited after authenticating with an administrator-privileged service account.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-250

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-90565.3Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation.CVE-2025-90576.4The Biagiotti Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.3 CVE-2025-90586.4The Mikado Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.5.2 due CVE-2025-90598.8The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hijacking.CVE-2025-90609.1A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs i CVE-2025-90616.4The Wilmer Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.4.5 due CVE-2025-90627.3Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter CVE-2025-90639.8An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vu CVE-2025-90649.1A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as th CVE-2025-90658.8A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. CVE-2025-90668.7A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can CVE-2025-90677.8A security issue exists within the x86 Microsoft Installer File (MSI), installed with FTLinx. Authenticated attackers with valid Windows use