ARKETEAM Protectel CVE-2025-68394

Requires an authenticated account on the Protectel application and the ability to supply the profilInput parameter; the CVE description states a low privileged user can trigger it, so standard (non-admin) authenticated access appears sufficient. Affected deployments are PROTECTELMAJ before v6.5.19 and BDF before v6.4.67. Limiting factors: authentication is required (the supplied vector says PR:H, the description says low-privileged - this is unresolved), and the vendor vector indicates adjacent-network access (AV:A), implying a LAN/internal-network deployment rather than open internet reachability; no user interaction is needed (UI:N). The exact injection mechanism beyond the profilInput parameter is not described in the available sources.

CVSS 4.0 base score of 8.4 (High) reflects HIGH confidentiality and integrity impact (VC:H/VI:H) with adjacent-network reach (AV:A), low complexity (AC:L) and no user interaction. However, the signals are incomplete and partly conflicting. No EPSS probability, CISA KEV listing, or POC/exploit reference is present in the input, so there is no evidence of active or imminent widespread exploitation; by the precision rules this is no public exploit identified at time of analysis. The vendor vector sets PR:H, but the CVE description explicitly says the injection is reached by a low privileged user - these contradict each other, which materially changes risk (a low-priv-exploitable SQLi is more dangerous than one needing admin); verify privilege level with the vendor/CERT-PL. The vuln.today decision label is this_week (not act_now or emergency), and a vendor patch is available, so this is a real but schedulable priority rather than a drop-everything incident, further tempered by the product being a niche ARKETEAM offering with limited deployment. Net: a genuine high-severity authenticated SQL injection worth patching promptly for the small population running it, but not a mass-exploitation emergency on current signals.

An attacker with a low-privileged authenticated account on an adjacent-network-reachable Protectel deployment submits a crafted value in the profilInput parameter; because input is not properly neutralized, the backend executes attacker-controlled SQL. This lets them read or alter sensitive database contents (VC:H/VI:H) without any user interaction. No public exploit code or POC reference is provided in the available sources.