EUVD-2025-208695Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security Browser cache control
|
| Impact | The CVSS:4.0 vector AV:L/AC:L/AT:P/PR:L/UI:P indicates a local attack vector with low complexity, requiring a low privilege level (standard user) and some user interaction (UI), but with a physical proximity requirement. The attack produces high impact on confidentiality (VC:H), integrity (SI:H), and availability (SA:H) of the system. While CVSS 6.0 appears moderate, the real-world risk is substantially elevated because: (1) the vulnerability enables direct privilege escalation from user to administrator, (2) the attack requires only local access and standard user privileges with no special tools, (3) the exploit is trivial (browser cache inspection), and (4) the impact affects the entire compromised system's security posture. This is a high-priority vulnerability in practice despite the moderate CVSS score, as it directly compromises Active Directory-integrated credential management. The exploitation likelihood is very high given that browser cache is easily accessible and requires no technical sophistication. |
| Exploit ScenarioDerived | An attacker with standard user privileges on a corporate workstation notices that an administrator recently used LAPSWebUI to retrieve LAPS passwords via their web browser. The attacker opens the browser developer tools (F12) and inspects the browser's localStorage or sessionStorage, finding plaintext or minimally obfuscated LAPS passwords cached by the vulnerable application. The attacker uses these credentials to log in as the local administrator, gaining full system access and enabling further lateral movement or persistence mechanisms within the network. This scenario is trivially executable and requires no special tools or exploits beyond browser inspection features. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
LAPSWebUI before version 2.4 by Truesec improperly caches LAPS (Local Administrator Password Solution) passwords in browser storage, allowing a local attacker with user-level access to retrieve plaintext or weakly protected admin credentials from the browser cache. An attacker who gains access to a workstation where an administrator has used LAPSWebUI can escalate privileges to local administrator by exploiting this caching behavior. While the CVSS score is moderate at 6.0, the practical impact is high because successful exploitation directly enables privilege escalation to administrative access.
RemediationAI
Immediately upgrade Truesec LAPSWebUI to version 2.4 or later, which remediates the browser caching issue by implementing proper cache control headers and in-memory-only password handling. Consult the Truesec security advisory for specific upgrade procedures and any data migration requirements. As an interim mitigation pending patching, restrict access to systems running LAPSWebUI to only trusted administrators, enforce browser auto-logout and cache clearing policies via group policy or browser configuration management, disable browser caching for the LAPSWebUI domain using HTTP headers (Cache-Control: no-store, no-cache; Pragma: no-cache), and audit browser cache and temporary files on systems where administrators have accessed LAPSWebUI to detect any previously cached credentials.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LAPSWebUI is a web-based management interface for Microsoft's Local Administrator Password Solution (LAPS), which rotates and securely stores local administrator passwords in Active Directory. The vulnerability stems from CWE-525 (Use of Web-Browser Cache Containing Sensitive Information), where sensitive authentication credentials are stored in browser cache mechanisms (such as browser localStorage, sessionStorage, or HTTP cache headers) without sufficient protection. The root cause is improper cache control directives and lack of memory-only handling for LAPS password data. The affected product is Truesec's LAPSWebUI, identified by CPE string cpe:2.3:a:truesec:lapswebui. When administrators retrieve LAPS passwords through the web UI prior to version 2.4, the application fails to clear or encrypt cached copies of these passwords, leaving them accessible to subsequent users of the same workstation.
Know when Lapswebui gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Browser caching of LAPS passwords in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin passwords.
Executive ViewAI
CVE-2025-15554 presents moderate security risk rated CVSS 6.0. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB