Cyber Resilience

CVE-2025-3773

Trellix System Information Reporter ≤ 1.0.3

Published
26 June 2025
Modified
17 June 2026
CVSS Score v4 0.0
Click a component to see what it means
Raw vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0012 3th percentile
Risk Priority 19 floored blend · peak EPSS

Summary

CVE-2025-3773 is a uncategorised-severity Exposure of Backup File to an Unauthorized Control Sphere (CWE-530) vulnerability in Trellix System Information Reporter. Its CVSS base score is 0.0.

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authenticated non-admin local user to extract sensitive information stored in a registry backup folder.

CWE(s)
CWE-530

Related Threats

MITRE ATT&CK Enterprise Techniques

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1025 Data from Removable Media Collection
Adversaries may search connected removable media on computers they have compromised to find files of interest.
attack.mitre.org →
T1039 Data from Network Shared Drive Collection
Adversaries may search network shares on computers they have compromised to find files of interest.
attack.mitre.org →
T1530 Data from Cloud Storage Collection
Adversaries may access data from cloud storage.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-3722Same product: Trellix System Information Reporter
CVE-2025-3771Same product: Trellix System Information Reporter
CVE-2024-3128Shared CWE-530
CVE-2024-3430Shared CWE-530
CVE-2024-12330Shared CWE-530
CVE-2024-2567Shared CWE-530
CVE-2024-3124Shared CWE-530
CVE-2023-1388Same vendor: Trellix
CVE-2023-6070Same vendor: Trellix
CVE-2024-5957Same vendor: Trellix

Affected Assets

trellix
system information reporter
≤ 1.0.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Enforces authorization checks on all logical access, directly stopping unauthorized actors from reaching backup files.

MP-2 Media Access good match

Explicitly restricts access to removable or backup media to authorized personnel only.

AC-6 Least Privilege good match

Limits privileges so that only the minimal set of users can access backup locations or archives.

MP-4 Media Storage good match

Requires physical and logical controls plus encryption or access restrictions when storing backup media.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-11 mostly match
prevents

Explicit requirement to protect backups directly mitigates unauthorized exposure of backup files.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.18 Access rights mostly match
prevents

Proper access-rights provisioning prevents unauthorized actors from reaching backup locations.

A.8.13 Information backup mostly match
prevents

The backup control explicitly requires protecting backup confidentiality and integrity, directly addressing exposure risks.

A.8.3 Information access restriction mostly match
prevents

Information-access-restriction rules can be applied to backup directories or archives to block unauthorized spheres.

A.5.12 Classification of information partial match
mitigates

Classification helps identify which backups need stricter handling, but does not enforce storage location or access restrictions.

A.5.15 Access control partial match
prevents

Access control directly limits who can reach backup files, though it does not address how backups are created or stored.

A.7.10 Storage media partial match
mitigates

Storage-media controls govern where and how backups are physically or logically stored, directly mitigating exposure.

References