Lapswebui CVE-2025-15553

The CVSS v4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:P) indicates low attack complexity but requires local access and prior authentication, significantly limiting exploitation scope. The CVSS score of 6.0 places this in the Medium severity range rather than Critical or High. The true risk hinges on environmental factors: organizations with shared workstations, lax physical security, or high-privilege LAPS credential exposure face elevated risk, while those enforcing strong workstation access controls see reduced practical impact. The vulnerability does not appear in CISA KEV as of available data, suggesting active exploitation remains limited. Remediation is straightforward (version upgrade to 2.4+), and no public POC has been widely circulated, further reducing immediate threat probability. From an SSVC perspective, this is remediable and not yet widely exploited, warranting routine patching schedules rather than emergency response.

An attacker gains initial low-privilege access to a shared workstation (e.g., a service account, temp staff, or compromised domain user) and observes that a system administrator recently logged into LAPSWebUI to retrieve local admin credentials but failed to properly log out (or the logout was ineffective). The attacker browses the browser cache, application memory, or browser storage and recovers the cached admin password, then uses it to escalate privileges on the local system or pivot laterally within the network. Exploitation requires the attacker to be present on the workstation during or immediately after admin use, making this scenario plausible in environments with shared administrative terminals.