CVE-2025-2449
Published: 18 March 2025
Summary
CVE-2025-2449 is a high-severity Path Traversal (CWE-22) vulnerability in Ni Flexlogger. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 4.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the core issue of insufficient validation of user-supplied paths in URI file parsing by requiring validation of all inputs to prevent directory traversal and arbitrary file creation.
Ensures timely flaw remediation through patching the specific directory traversal vulnerability in the usiReg component of NI FlexLogger.
Enforces access control policies to restrict unauthorized file operations resulting from path traversal exploits.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Client-side RCE vulnerability in desktop application triggered by user opening malicious file or visiting malicious link, directly enabling T1203 exploitation for client execution and T1204 user execution.
NVD Description
NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability in that the target must…
more
visit a malicious page or open a malicious file. The specific flaw exists within the parsing of URI files by the usiReg component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21805.
Deeper analysisAI
CVE-2025-2449 is a directory traversal vulnerability in the usiReg component of NI FlexLogger that enables remote code execution. The issue stems from insufficient validation of user-supplied paths during URI file parsing, allowing attackers to create arbitrary files on affected installations. Published on 2025-03-18, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and maps to CWE-22; it was previously tracked as ZDI-CAN-21805.
Remote attackers without privileges can exploit this vulnerability by luring a target user into visiting a malicious web page or opening a malicious file. User interaction is required, after which the attacker can leverage the path traversal to write files and execute arbitrary code in the context of the current user, potentially compromising confidentiality, integrity, and availability.
The Zero Day Initiative advisory (ZDI-25-146), available at https://www.zerodayinitiative.com/advisories/ZDI-25-146/, provides further details on the vulnerability.
Details
- CWE(s)