CVE-2025-61197
Published: 06 October 2025
Summary
CVE-2025-61197 is a high-severity Client-Side Enforcement of Server-Side Security (CWE-602) vulnerability. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-61197 is a privilege escalation vulnerability affecting Orban Optimod audio processing devices, including models 5950, 5950HD, 5750, 5750HD, and Trio Optimod running application version 1.0.0.33 on system version 2.5.26. The flaw stems from the application storing user privilege and role information in client-side browser storage, which violates server-side enforcement principles as classified under CWE-602. Published on 2025-10-06, it carries a CVSS v3.1 base score of 8.9 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L).
A remote attacker with low privileges (PR:L) can exploit this over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R). Exploitation changes the scope (S:C), enabling high impacts on confidentiality and integrity (C:H/I:H) alongside low availability impact (A:L), allowing the attacker to escalate privileges by manipulating stored role data in the browser.
Mitigation details can be found in resources such as the vendor site at https://www.orban.com/ and the vulnerability research repository at https://github.com/giulioschiavone/Vulnerability-Research/tree/main/CVE-2025-61197.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-32166
Vulnerability details
An issue in Orban Optimod 5950, Optimod 5950HD, Optimod 5750, Optimod 5750HD, Optimod Trio Optimod version 1.0.0.33 - System version 2.5.26 allows a remote attacker to escalate privileges via the application stores user privilege/role information in client-side browser storage
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a privilege escalation flaw exploited by manipulating client-side browser storage to bypass server-side controls, directly enabling T1068: Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces server-side access control policies independent of client-side browser storage, directly preventing privilege escalation via manipulation of stored user role information.
Validates privilege and role information inputs received from the client-side browser storage, rejecting tampered data to block exploitation.
Applies least privilege enforced server-side, limiting the scope and impact of any successful client-side privilege manipulation.