CVE-2025-25711
Published: 12 March 2025
Summary
CVE-2025-25711 is a high-severity Improper Preservation of Permissions (CWE-281) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 34.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations on the /tnexus/rest/admin/updateUser API endpoint to prevent unauthorized privilege escalation via ProfileID manipulation.
Validates the ProfileID parameter in API requests to ensure it aligns with the authenticated user's existing permissions, blocking tampering attempts.
Implements least privilege to restrict the privileges assignable via the updateUser endpoint, limiting escalation potential even if enforcement partially fails.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a privilege escalation vulnerability allowing an authenticated low-privileged user to elevate access by manipulating ProfileID in an API request, directly mapping to exploitation of a software vulnerability for privilege escalation.
NVD Description
An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the ProfileID value to the [/tnexus/rest/admin/updateUser] API endpoint
Deeper analysisAI
CVE-2025-25711 is a privilege escalation vulnerability in dtp.ae tNexus Airport View version 2.8. The issue allows a remote attacker to escalate privileges by manipulating the ProfileID value in requests to the /tnexus/rest/admin/updateUser API endpoint. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-281 (Improper Preservation of Permissions). The vulnerability was published on 2025-03-12.
The attack requires low privileges (PR:L) and can be carried out remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). An authenticated attacker with basic access can exploit the flawed API endpoint to elevate their privileges, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).
A related research repository is available at https://github.com/z5jt/vulnerability-research/tree/main/CVE-2025-25710, which may provide additional technical details.
Details
- CWE(s)