CVE-2025-22956

9.8 criticalEPSS 0.4%

Critical (9.8). EPSS 0.4% chance of exploitation in the next 30 days.

OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients. This can lead to privilege escalation if any ProductPropertyState contains a secret only intended to be accessible by a subset of clients. One example of this is a domain join account password for the windomain package.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2025-09-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://opsi.org/en/product/releases/#4.3-20250129054911

Check your stack JSON