CVE-2025-10641CWE-319

CVE-2025-10641

High · published October 21, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

⚡ All WorkExaminer Professional traffic is flowing like an open book! The data is transmitted in plain text, making it all too easy for a nearby attacker to read and even alter the sensitive information. 🔥 Think of it like sending postcards with all your secrets written on them. Anyone nearby can read your messages and even scribble in their own details before they reach the recipient! An attacker with network access could intercept confidential data, read sensitive information such as user credentials, or even tamper with data being sent between clients and servers. This could lead to unauthorized access, data integrity issues, and a serious breach of privacy, leaving users exposed.

Put simply

Think of it like sending postcards with all your secrets written on them. Anyone nearby can read your messages and even scribble in their own details before they reach the recipient! This vulnerability arises from the use of unencrypted FTP for data transmission between monitoring clients and the server on port 12304, as well as unencrypted communication between the console client and the server on port 12306. This makes all transmitted data vulnerable to interception and modification by attackers on the same network.

What to do

An attacker with network access could intercept confidential data, read sensitive information such as user credentials, or even tamper with data being sent between clients and servers. This could lead to unauthorized access, data integrity issues, and a serious breach of privacy, leaving users exposed. To remediate this vulnerability, configure the FTP service to use a secure transfer protocol (like SFTP or FTPS) instead of plain FTP. Additionally, ensure that all data traffic between the console and server is encrypted to protect sensitive information. Regularly audit your network for any unencrypted services. You've got this! With these steps, you'll secure your data transmission and protect your users. 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00315 · 23.2th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2025-10-21T16:15Z
References (2)
EPSS history
Timeline
  • 21 OCT 11:48Z
    Unencrypted cleartext communication in EfficientLab WorkExaminer Professional
    cvelistv5