PiExtract SOOP-CLM CVE-2025-11674

Exploitation requires an authenticated session with HIGH privileges (PR:H) on the SOOP-CLM application - the description explicitly scopes this to 'privileged remote attackers,' meaning an administrative or equivalently trusted account is a hard prerequisite. The vulnerable behavior is a server-side URL-fetch/resource-retrieval function that accepts attacker-influenced destinations, enabling the server to read local files or reach internal network resources. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L) once privileged access is held. Primary limiting factors: the high privilege requirement (significantly shrinks the viable attacker set to insiders or post-compromise actors) and the product's limited, likely regional deployment footprint.

This is a moderate-severity SSRF (CWE-918) in PiExtract's SOOP-CLM, rated CVSS 4.0 6.9 (MEDIUM). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N) is internally consistent with the description: network-reachable, low complexity, but requiring HIGH privileges (PR:H), yielding high confidentiality impact (reading server files) with limited subsequent-system exposure (SC:L, internal network probing). The PR:H requirement is the dominant risk-limiting factor - this is explicitly described as exploitable only by 'privileged remote attackers,' so it is a post-authentication issue usable by an already-trusted or compromised privileged account, not a pre-auth mass-exploitation threat. EPSS is low at 0.36% (27th percentile), the CVE is NOT in CISA KEV, and no public exploit code was identified, so the exploitation-probability signals align downward and do not conflict. Net assessment: a real but contained issue best prioritized for defense-in-depth and insider/post-compromise hardening rather than emergency patching; the high-privilege gate plus obscure product footprint make widespread opportunistic exploitation unlikely.

An attacker who already holds privileged (administrative) access to a SOOP-CLM instance - or who has compromised such an account - supplies a crafted URL to a feature that fetches remote resources, causing the server to issue requests on the attacker's behalf. This is used to read local server files or to enumerate and probe otherwise-unreachable internal network hosts and services. No public proof-of-concept exploit was identified at time of analysis.