CVE-2025-1417
Information disclosure in Proget MDM
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Information disclosure in Proget MDM
In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM (Mobile Device Management). This information include user ids, email addresses, first names, last names and device UUIDs. The last one can be used for exploitation of CVE-2025-1416. Successful exploitation requires UUID of a targeted backup, which cannot be brute forced. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Reserved 2025-02-18 | Published 2025-05-21 | Updated 2025-05-21 | Assigner CERT-PLCWE-863 Incorrect Authorization
Marcin Węgłowski (AFINE)
cert.pl/en/posts/2025/05/CVE-2025-1415
proget.pl/en/mobile-device-management/
Support options
