CVE-2025-61197

High

Published: 06 October 2025

Published

06 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

EPSS Score 0.0011 29.1th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-61197 is a high-severity Client-Side Enforcement of Server-Side Security (CWE-602) vulnerability. Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces server-side access control policies independent of client-side browser storage, directly preventing privilege escalation via manipulation of stored user role information.

SI-10 Information Input Validation good match

prevent

Validates privilege and role information inputs received from the client-side browser storage, rejecting tampered data to block exploitation.

AC-6 Least Privilege partial match

prevent

Applies least privilege enforced server-side, limiting the scope and impact of any successful client-side privilege manipulation.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

The vulnerability is a privilege escalation flaw exploited by manipulating client-side browser storage to bypass server-side controls, directly enabling T1068: Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

An issue in Orban Optimod 5950, Optimod 5950HD, Optimod 5750, Optimod 5750HD, Optimod Trio Optimod version 1.0.0.33 - System version 2.5.26 allows a remote attacker to escalate privileges via the application stores user privilege/role information in client-side browser storage

Deeper analysisAI

CVE-2025-61197 is a privilege escalation vulnerability affecting Orban Optimod audio processing devices, including models 5950, 5950HD, 5750, 5750HD, and Trio Optimod running application version 1.0.0.33 on system version 2.5.26. The flaw stems from the application storing user privilege and role information in client-side browser storage, which violates server-side enforcement principles as classified under CWE-602. Published on 2025-10-06, it carries a CVSS v3.1 base score of 8.9 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L).

A remote attacker with low privileges (PR:L) can exploit this over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R). Exploitation changes the scope (S:C), enabling high impacts on confidentiality and integrity (C:H/I:H) alongside low availability impact (A:L), allowing the attacker to escalate privileges by manipulating stored role data in the browser.

Mitigation details can be found in resources such as the vendor site at https://www.orban.com/ and the vulnerability research repository at https://github.com/giulioschiavone/Vulnerability-Research/tree/main/CVE-2025-61197.