Cyber Resilience

CVE-2025-52926

Published
23 June 2025
Modified
17 June 2026
CVSS Score v3.1 2.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N
EPSS Score 0.0014 4th percentile
Risk Priority 23 floored blend · peak EPSS

Summary

CVE-2025-52926 is a low-severity Omission of Security-relevant Information (CWE-223) vulnerability. Its CVSS base score is 2.7 (Low).

Operationally, ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AU-12 (Audit Record Generation) and AU-2 (Event Logging) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A09:2025 Security Logging and Alerting Failures

EU & UK References

Vulnerability Data

In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface.

CWE(s)
CWE-223

Related Threats

CVEs Like This One

CVE-2024-52813Shared CWE-223
CVE-2023-31191Shared CWE-223
CVE-2023-28360Shared CWE-223
CVE-2023-29156Shared CWE-223
CVE-2026-31890Shared CWE-223

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AU-12 Audit Record Generation good match

Ensures the system can generate audit records for defined events, reducing the chance of systematic omission.

AU-2 Event Logging good match

Requires identification and logging of security-relevant event types, directly stopping omission of attack or safety information.

AU-3 Content of Audit Records good match

Mandates that audit records contain the specific details needed to identify sources, nature, and safety of actions.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.AE-02 mostly match
degrades

CWE-223 omits exactly the security details that DE.AE-02's log analysis and SIEM monitoring rely on, largely blinding the outcome while still leaving non-omitted data usable.

DE.AE-04 mostly match
degrades

CWE-223's omission of attack-relevant details largely blinds impact/scope estimation (DE.AE-04), removing most of its efficacy while not quite defeating every possible manual or external-data workaround.

DE.AE-06 mostly match
degrades

CWE-223 directly omits the security-relevant data that DE.AE-06 must deliver, largely defeating the outcome's purpose while not always eliminating every possible channel.

DE.AE-07 mostly match
degrades

CWE-223 omits the raw security data that DE.AE-07 must integrate with CTI, largely starving the analysis outcome in both directions.

DE.AE-08 mostly match
degrades

Missing security-relevant data largely blinds the criteria-based incident declaration process, removing most of its efficacy without making it completely impossible.

DE.CM-06 mostly match
degrades

CWE-223 omission directly blinds DE.CM-06 monitoring of external-provider activity by withholding the very security-relevant data needed to detect adverse events, impairing most (but not all) of the outcome's scope.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.15 Logging full match
prevents

Logging directly requires recording security-relevant events that the weakness omits.

A.5.28 Collection of evidence partial match
degrades

Evidence collection depends on logs and records that the weakness fails to produce.

A.8.16 Monitoring activities partial match
finds

Monitoring activities rely on the very information whose absence defines the weakness.

A.5.24 Information security incident management planning and preparation none match
none

Incident-management planning assumes the availability of the data the weakness fails to capture.

A.5.25 Assessment and decision on information security events none match
none

Event assessment requires the security-relevant details the weakness omits.

A.5.26 Response to information security incidents none match
none

Incident response effectiveness is reduced without the omitted information.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Ubuntu 22.04 (2 rules)
  • V-260591 Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time. prevents CWE-223
  • V-260590 Ubuntu 22.04 LTS must have the "auditd" package installed. prevents CWE-223
Ubuntu 24.04 (2 rules)
  • V-270656 Ubuntu 24.04 LTS must have the "auditd" package installed. prevents CWE-223
  • V-270657 Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time. prevents CWE-223

References