YouTube video by The Infographics Show

SEC Consult SA-20251021-0 :: Multiple Vulnerabilities in EfficientLab WorkExaminer Professional (CVE-2025-10639, CVE-2025-10640, CVE-2025-10641) Full Disclosure mailing list archives From: SEC Consult Vulnerability Lab via Fulldisclosure Date: Tue, 21 Oct 2025 11:40:34 +0000 SEC Consult Vulnerability Lab Securi ... Read more Published Date: Oct 21, 2025 (2 hours, 40 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-10641 CVE-2025-10640 CVE-2025-10639

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 21SEC Consult Vulnerability Lab Security Advisory < 20251021-0 > ======================================================================= title: Multiple Vulnerabilities product: EfficientLab WorkExaminer Professional vulnerable version: <= 4.0.0.52001 fixed version: - CVE number: CVE-2025-10639, CVE-2025-10640, CVE-2025-10641 impact: Critical homepage:...

An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks to bypass the login prompt in the WorkExaminer Professional console to gain administrative access to the WorkExaminer server and therefore all sensitive monitoring data. This includes monitored screenshots and keystrokes of …

All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the network to read the transmitted sensitive data. An attacker can also freely modify the data on the wire. The monitoring clients transmit their data to the server …

The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain …