EUVD-2025-208691Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V7 - Session Management Session expiration enforcement
|
| Impact | The CVSS 4.0 score of 6.0 with attack vector Local (AV:L), low complexity (AC:L), and partial privileges required (PR:L) indicates moderate severity with realistic exploitation potential. The vector shows high impact on confidentiality (VC:H) and integrity (SI:H) of the system, with significant impact on availability (SA:H), reflecting the critical nature of password disclosure combined with privilege escalation. The CVSS vector's requirement for local access and user-level privileges (PR:L, UI:P) means this is not remotely exploitable but poses genuine risk in environments with multi-user workstations or shared lab facilities. While EPSS data is not provided here, session expiration flaws typically exhibit moderate-to-high exploitability probability because session fixation and reuse attacks are well-understood and require minimal technical sophistication. The real-world risk is elevated by the fact that this vulnerability directly exposes LAPS-managed administrator credentials—the very secrets that LAPS is designed to protect—making this a critical control bypass rather than a mere access control issue. Organizations should treat this as high priority because successful exploitation completely undermines the security posture of their LAPS deployment. |
| Exploit ScenarioDerived | An attacker with a regular user account on a shared workstation logs into LAPSWebUI, views local administrator credentials, and then logs out. Before the session times out, the attacker (or another attacker with physical access to the same workstation) reuses the abandoned session cookie or token via browser tools or direct HTTP requests to re-access the password disclosure endpoint without re-authenticating. The attacker successfully retrieves the local administrator password and uses it to escalate privileges on the workstation or pivot to other systems on the network. This scenario is practical because the attack vector is Local (AV:L) with only user-level privileges required (PR:L), meaning any authenticated user on a multi-user system can attempt exploitation without advanced skills. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
Insufficient Session Expiration in Truesec's LAPSWebUI before version 2.4 allows local attackers with user-level privileges to obtain local administrator passwords through inadequate session management controls. An attacker with physical or logical access to a workstation can exploit this vulnerability to escalate privileges and disclose sensitive credentials, potentially compromising domain administration. This vulnerability represents a practical privilege escalation risk in environments relying on LAPS (Local Administrator Password Solution) for credential management.
RemediationAI
Immediately upgrade Truesec LAPSWebUI to version 2.4 or later, which contains fixes for session expiration handling. Verify the upgrade through Truesec's official advisory and release notes. As interim mitigations pending patching, enforce strict network segmentation to limit access to the LAPSWebUI application to trusted administrative networks only, implement aggressive session timeout policies at the web server level (ideally 15–30 minutes of inactivity), deploy multi-factor authentication (MFA) for all LAPSWebUI access, and monitor session logs for anomalous reuse patterns. Additionally, restrict local access to workstations running LAPSWebUI clients and consider disabling password disclosure features until the patch can be applied if operational security allows.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LAPSWebUI is a web-based administrative interface for managing Microsoft's Local Administrator Password Solution (LAPS), which centrally manages local administrator account passwords across enterprise networks. The vulnerability stems from CWE-613 (Insufficient Session Expiration), a session management flaw where user sessions remain valid beyond their intended lifetime or are not properly terminated under specified conditions. Truesec's implementation fails to enforce adequate session timeout mechanisms or properly invalidate sessions when users disconnect, allowing attackers to reuse stale session tokens to access password disclosure functionality. The affected product operates as a web application (CPE prefix cpe:2.3:a:truesec:lapswebui) and interacts with Active Directory and LAPS infrastructure to retrieve and display sensitive local administrator credentials, making improper session handling particularly dangerous.
Know when Lapswebui gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Insufficient Session Expiration in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password.
Executive ViewAI
CVE-2025-15552 presents moderate security risk rated CVSS 6.0. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB