Incorrect default permissions in Intercom, Inc. Security Point of MaLion
Priority LOW 21CWE-276Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Incorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an arbitrary file could be placed in the specific folder by a user who can log in to the system where the product's Windows client is installed. If the file is a specially crafted DLL file, arbitrary code could be executed with SYSTEM privilege.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00119 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Intercom, Inc. | Security Point (Windows) of MaLion | prior to Ver.5.3.4 | — | No fix listed | CNA |
- Security Point (Windows) of MaLion VendorIntercom, Inc. Affected prior to Ver.5.3.4 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59485
- 2026-10-03 Alias added: GHSA-4vgq-c77f-v94g
References
More Intercom, Inc. vulnerabilities
- TI-2017-07918 Improper authentication in Intercom, Inc. MaLion for Windows and Mac CVSS 3.1CRITICAL 9.8
- TI-2017-07919 Hard-coded credentials in Intercom, Inc. MaLion for Windows and Mac CVSS 3.1CRITICAL 9.8
- TI-2017-07917 SQL injection in Intercom, Inc. MaLion for Windows and Mac CVSS 3.1CRITICAL 9.8
- TI-2025-40042 Heap-based buffer overflow in Intercom, Inc. Security Point of MaLion CVSS 4.0CRITICAL 9.3
- TI-2025-38883 Stack-based buffer overflow in Intercom, Inc. Security Point of MaLion CVSS 4.0CRITICAL 9.3
- TI-2017-07916 Improper authentication in Intercom, Inc. MaLion for Windows CVSS 3.0HIGH 8.1
Sources
- CVE-2025-59485 · CVE Program
- CVE-2025-59485 · NVD
- FIRST EPSS
- GHSA-4vgq-c77f-v94g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences