Which versions of Profisee are affected by CVE-2025-6240?

CVE-2025-6240 presents moderate security risk, a input validation vulnerability rated CVSS 5.0. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-6240?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Profisee CVE-2025-6240

Q: What is the CVSS score of CVE-2025-6240?

CVE-2025-6240 has a CVSS 4.0 base score of 4.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:M/U:Green. EPSS exploitation probability: 0.1%.

EUVD-2025-18645 MEDIUM

Improper Input Validation (CWE-20)

2025-06-18 c0ec9282-ea44-45d7-9b32-48d87cb37538

Path Traversal Microsoft

4.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:M/U:Green

vuln.today AI

2.6 LOW

High privileges and user interaction required; scope change to subsequent systems.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.0 (MEDIUM) 4.9 (MEDIUM)

Patch available

Apr 16, 2026 - 05:29 EUVD

2024R2

EUVD ID Assigned

Mar 14, 2026 - 22:49 euvd

EUVD-2025-18645

Analysis Generated

Mar 14, 2026 - 22:49 vuln.today

CVE Published

Jun 18, 2025 - 15:15 nvd

MEDIUM 5.0

DescriptionCVE.org

Improper Input Validation vulnerability in Profisee on Windows (filesystem modules) allows Path Traversal after authentication to the Profisee system.This issue affects Profisee: from 2020R1 before 2024R2.

AnalysisAI

Authenticated path traversal in Profisee on Windows allows attackers with high privileges to read sensitive files outside intended directories. The vulnerability affects filesystem modules in Profisee versions 2020R1 through 2024R1, with a patch available in 2024R2. EPSS score is low (0.08%), and no active exploitation or public exploit has been reported.

Technical ContextAI

The vulnerability is an improper input validation (CWE-20) in Profisee's filesystem modules, leading to path traversal. Profisee is a master data management platform running on Windows. The CVSS vector indicates a network attack with high complexity, requiring high privileges and user interaction. The path traversal allows reading files outside the intended directory, potentially exposing sensitive configuration or data files.

RemediationAI

Upgrade to Profisee 2024R2 or later, which contains the vendor-released patch. No workarounds are documented; as a compensating control, restrict network access to the Profisee application to trusted users and monitor for unusual file access patterns. The vendor advisory is at https://profisee.com/security/vulnerabilities/detail/.