{"document":{"acknowledgments":[{"organization":"CERT@VDE","summary":"coordination.","urls":["https://certvde.com"]}],"aggregate_severity":{"namespace":"https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale","text":"High"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"A privilege escalation vulnerability exists in Phoenix Contact Device and Update Management prior to version 2025.3.1 due to misconfigured permissions on nssm.exe in the DAUM-WINDOWS-SERVICE. This misconfiguration allows a low-privileged local user to execute arbitrary code with administrative privileges.\n","title":"Summary"},{"category":"description","text":"The products installer allows privileges escalation to admin rights caused by the nssm.exe. Nssm.exe is an open-source tool designed to simplify the management of Windows services.\nThe permissions on the nssm.exe were not secured properly, this could allow an attack to escalate privileges from a low privileged user to an administrator.\n","title":"Impact"},{"category":"description","text":"Update to the latest 2025.3.1 DaUM Version.","title":"Remediation"},{"category":"general","text":"Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).","title":"General Recommendation"}],"publisher":{"category":"vendor","contact_details":"psirt@phoenixcontact.com","name":"Phoenix Contact GmbH & Co. KG","namespace":"https://phoenixcontact.com/psirt"},"references":[{"category":"external","summary":"PCSA-2025/00010","url":"https://phoenixcontact.com/psirt"},{"category":"external","summary":"Phoenix Contact advisory overview at CERT@VDE","url":"https://certvde.com/de/advisories/vendor/phoenixcontact/"},{"category":"external","summary":"Phoenix Contact application note","url":"https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"},{"category":"self","summary":"VDE-2025-063: Phoenix Contact: Device and Update Management Windows Installer Privilege Escalation - HTML","url":"https://certvde.com/en/advisories/VDE-2025-063"},{"category":"self","summary":"VDE-2025-063: Phoenix Contact: Device and Update Management Windows Installer Privilege Escalation - CSAF","url":"https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-063.json"}],"source_lang":"en","title":"Phoenix Contact: Device and Update Management Windows Installer Privilege Escalation","tracking":{"aliases":["VDE-2025-063","PCSA-2025/00010"],"current_release_date":"2025-08-12T10:00:00.000Z","generator":{"date":"2025-08-07T09:38:30.028Z","engine":{"name":"Secvisogram","version":"2.5.31"}},"id":"VDE-2025-063","initial_release_date":"2025-08-12T10:00:00.000Z","revision_history":[{"date":"2025-08-12T10:00:00.000Z","number":"1","summary":"Initial"}],"status":"final","version":"1"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version_range","name":"DaUM<2025.3.1","product":{"name":"DaUM <2025.3.1","product_id":"CSAFPID-51001","product_identification_helper":{"model_numbers":["1542953"]}}},{"category":"product_version","name":"DaUM 2025.3.1","product":{"name":"DaUM 2025.3.1","product_id":"CSAFPID-52001","product_identification_helper":{"model_numbers":["1542953"]}}}],"category":"product_family","name":"Software"}],"category":"vendor","name":"Phoenix Contact GmbH & Co. KG"}]},"vulnerabilities":[{"cve":"CVE-2025-41686","cwe":{"id":"CWE-306","name":"Missing Authentication for Critical Function"},"notes":[{"category":"description","text":"A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001"],"known_affected":["CSAFPID-51001"]},"remediations":[{"category":"vendor_fix","date":"2025-08-12T10:00:00.000Z","details":"Phoenix Contact strongly recommends to upgrade to Update to the latest Version of the DaUM software which fixes this vulnerability.","product_ids":["CSAFPID-52001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","environmentalScore":7.8,"environmentalSeverity":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","temporalScore":7.8,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-51001"]}],"title":"CVE-2025-41686"}]}