CVE-2025-25497

8.1 highEPSS 0.4%

High (8.1). EPSS 0.4% chance of exploitation in the next 30 days.

An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Account Owner" field due to client-side-only restrictions and a lack of server-side validation. This vulnerability enables account ownership reassignment to or away from any user.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-602
Published: 2025-03-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://helpdesk.netsweeper.com/docs/8_2_Docs/8_2_Netsweeper_Docs/Content/Release_Notes/Netsweeper_Release_Notes/8_2_Release_Notes/8_2_7_Release_and_Downloads.htm
https://packetstorm.news/files/id/188626/

Check your stack JSON