Read the docs
TI-2025-00343 Aliases CVE-2025-0425GHSA-qpwg-qxx8-4g59

Local Privilege Escalation via Config Manipulation

Priority LOW 38CWE-15Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed Server" to which this client connects. This is dangerous as the "bestinformed Infoclient" runs with elevated permissions ("nt authority\system"). By changing the server address to a malicious server, or a script simulating a server, the user is able to escalate his privileges by abusing certain features of the "bestinformed Web" server. Those features include: * Pushing of malicious update packages * Arbitrary Registry Read as "nt authority\system" An attacker is able to escalate his privileges to "nt authority\system" on the Windows client running the "bestinformed Infoclient".  This attack is not possible if a custom configuration ("Infoclient.ini") containing the flags "ShowOnTaskbar=false" or "DisabledItems=stPort,stAddress" is deployed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0017 6th percentileScored 2026-11-07
Fix Fixed bestinformed Infoclient (Cordaware): 6.3.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cordawarebestinformed Infoclientbefore 6.3.7.06.3.7.0Patch availableCNA
  • bestinformed Infoclient VendorCordaware Affected before 6.3.7.0 Fixed in 6.3.7.0 Patch available CNA

Remediation

  • Fix · CNA bestinformed Infoclient (Cordaware) Fixed in 6.3.7.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-0425
  2. 2026-10-03 Alias added: GHSA-qpwg-qxx8-4g59

References

Advisory 1

  • TI-2019-04460 Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure… CVSS 3.0CRITICAL 9.8
  • TI-2025-00340 Authenticated Remote Code Execution via ScriptVar CVSS 4.0HIGH 8.6
  • TI-2019-04459 The Scripting and AutoUpdate functionality in Cordaware bestinformed Microsoft Windows… CVSS 3.0HIGH 7.8
  • TI-2025-00341 Multiple Unauthenticated Stored Cross-Site Scripting CVSS 4.0MEDIUM 5.3
  • TI-2025-00342 Multiple Authenticated Stored Cross-Site Scripting CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences