Openedge EUVD-2025-209437

The CVSS 4.0 score of 8.2 reflects high confidentiality impact to both vulnerable (VC:H) and subsequent systems (SC:H), with network attack vector (AV:N) and low complexity (AC:L) offset by high privilege requirements (PR:H). The attack requires authenticated administrative credentials, significantly reducing the attacker pool compared to unauthenticated vulnerabilities. SSVC assessment indicates exploitation status 'none', non-automatable attacks, and partial technical impact, suggesting this is not a mass-exploitation candidate. The absence of CISA KEV listing and public exploit code means real-world exploitation risk depends heavily on insider threat scenarios or post-compromise lateral movement where administrative credentials are already obtained. The primary risk lies in environments where AdminServer credentials are shared, inadequately rotated, or where administrators are untrusted. While the CVSS score is high, practical exploitation barriers (authentication, targeted nature, SSVC 'partial' impact) place this below critical mass-exploitation vulnerabilities. Organizations with strong administrative access controls and credential management face lower immediate risk than those with loose admin account governance. The confidentiality-only impact (no integrity or availability) limits damage to information disclosure rather than system compromise, though exposed files may contain credentials or configuration data enabling further attacks.

An authenticated administrator with legitimate AdminServer RMI access discovers the setFile() and openFile() methods through RMI introspection or documentation. By crafting RMI calls with path traversal sequences (e.g., ../../../../etc/shadow or C:\Windows\System32\config\SAM), they invoke openFile() to read sensitive system files that their user account normally cannot access. Because the method executes under the AdminServer's elevated privileges (often root on Unix or SYSTEM on Windows), the OS permits the read operation. The attacker retrieves database connection strings from configuration files, SSL private keys, or password hashes, enabling lateral movement or privilege escalation in the broader environment. The attack leaves minimal forensic traces since it uses legitimate RMI channels rather than anomalous system calls.