CVE-2025-58742
Published: 20 January 2026
Summary
CVE-2025-58742 is a high-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Milner Imagedirector Capture. Its CVSS base score is 8.5 (High).
Operationally, ranked at the 5.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206309
Vulnerability details
Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Connection Settings dialog in Milner ImageDirector Capture on Windows allows Adversary in the Middle (AiTM) by modifying the 'Server' field to redirect client authentication.This issue affects…
more
ImageDirector Capture: from 7.0.9 before 7.6.3.25808.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Authorizing wireless access restricts the wireless communication channel to only intended endpoints.
Training instructs users on protecting credentials from disclosure or unauthorized access.
Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.
Approving specific exchanges and documenting interface characteristics restricts communication channels to only intended endpoints and systems.
Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.
Limits physical connectivity to transmission channels, supporting restriction of communication paths to only intended endpoints.
Rules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials.
Terminating or revoking credentials stops use of insufficiently protected or lingering credentials post-termination.