Workspace Control CVE-2025-5353

This vulnerability presents HIGH real-world risk despite requiring local authentication. CVSS 8.8 (High) reflects: AV:L (local-only attack), AC:L (low complexity—hardcoded key is static), PR:L (requires authenticated user—but in enterprise contexts, compromised employee accounts or supply-chain compromises are realistic), UI:N (no user interaction), S:C (scope change—impact extends beyond Workspace Control to backend SQL databases), C:H/I:H/A:H (confidentiality, integrity, availability all compromised). The local + authenticated requirement is NOT a mitigating factor in practice because: (1) insider threats are common, (2) lateral movement after initial compromise frequently exploits local services, (3) privilege escalation chains often chain this vulnerability, and (4) SQL databases typically hold sensitive business data. Without EPSS and KEV status data provided, the vulnerability should be treated as high-priority for patching, particularly in enterprises where Ivanti Workspace Control manages critical infrastructure. If KEV/CISA inclusion or POC availability is confirmed, urgency escalates to critical.

An attacker gains low-privileged access to a corporate workstation running Ivanti Workspace Control (e.g., via phishing, weak password, or lateral movement post-initial-breach). The attacker accesses the application's configuration directory or memory using local tools, extracts the hardcoded encryption key embedded in the Workspace Control binary/config. Using the key, the attacker decrypts stored SQL credentials visible in plaintext or within encrypted configuration blobs. The attacker then connects directly to the backend SQL database (e.g., MS SQL Server, Oracle) using the stolen credentials, exfiltrating sensitive business data, creating backdoors, or disrupting availability. This is particularly dangerous in healthcare, finance, or manufacturing environments where Workspace Control manages critical systems. If the SQL database credentials have administrative privileges (common misconfiguration), the attacker gains full database control and can pivot to other connected systems.