CVE-2025-0542
High
Description
Local privilege escalation due to incorrect assignment of privileges of temporary files in the update mechanism of G DATA Management Server. This vulnerability allows a local, unprivileged attacker to escalate privileges on affected installations by placing a crafted ZIP archive in a globally writable directory, which gets unpacked in the context of SYSTEM and results in arbitrary file write.
SeverityHigh
CVSS7.8
Exploit probability—
ProductG DATA Management Server
PublishedJan 25, 2025
First seenJan 25, 2025
Weakness typeCWE-276CWE-276CWE-22Path traversal
How to fix
Update
- G DATA CyberDefense AG G DATA Management Server15.8.333 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| G DATA CyberDefense AG G DATA Management Server | v < 15.8.333 | 15.8.333 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.