CVE-2025-2449
Published: 18 March 2025
Summary
CVE-2025-2449 is a high-severity Path Traversal (CWE-22) vulnerability in Ni Flexlogger. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 4.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-2449 is a directory traversal vulnerability in the usiReg URI file parsing component of NI FlexLogger that permits remote attackers to create arbitrary files on affected installations. The flaw stems from insufficient validation of user-supplied paths during file operations and carries a CVSS 3.1 score of 8.8 with a CWE-22 classification.
An unauthenticated remote attacker can exploit the issue by convincing a target to visit a malicious page or open a malicious file, after which code execution occurs in the context of the current user. No special privileges are required on the part of the attacker beyond the social-engineering step.
The sole referenced advisory is ZDI-25-146 from the Zero Day Initiative, which documents the vulnerability as ZDI-CAN-21805. The EPSS score has remained flat at 0.1975 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7565
Vulnerability details
NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability in that the target must…
more
visit a malicious page or open a malicious file. The specific flaw exists within the parsing of URI files by the usiReg component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21805.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Client-side RCE vulnerability in desktop application triggered by user opening malicious file or visiting malicious link, directly enabling T1203 exploitation for client execution and T1204 user execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the core issue of insufficient validation of user-supplied paths in URI file parsing by requiring validation of all inputs to prevent directory traversal and arbitrary file creation.
Ensures timely flaw remediation through patching the specific directory traversal vulnerability in the usiReg component of NI FlexLogger.
Enforces access control policies to restrict unauthorized file operations resulting from path traversal exploits.