CVE-2025-43720

6.5 mediumEPSS 0.4%

Medium (6.5) in h-mdm headwind mdm. EPSS 0.4% chance of exploitation in the next 30 days.

Headwind MDM before 5.33.1 makes configuration details accessible to unauthorized users. The Configuration profile is exposed to the Observer user role, revealing the password requires to escape out of the MDM controlled device's profile.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2025-07-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

h-mdm:headwind_mdm

References

https://github.com/h-mdm/hmdm-server/commit/19e4a63f732c99064444df7e8c61b4f01df362e8
https://github.com/h-mdm/hmdm-server/compare/v5.32.1...v5.33.1
https://www.periculo.co.uk/cyber-security-blog/how-our-pen-tester-found-a-critical-vulnerability-cve-2025-43720

Check your stack JSON