---
cve: "CVE-2025-10640"
severity: "CRITICAL"
cvss: 9.8
epss: "0.9%"
vendor: "EfficientLab"
kev: false
exploited: false
published: "2025-10-21 12:15:35"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-08T17:43:36+01:00"
---

# CVE-2025-10640

> 9.8 CRITICAL

## Beschreibung

An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks to bypass the login prompt in the WorkExaminer Professional console to gain administrative access to the WorkExaminer server and therefore all sensitive monitoring data. This includes monitored screenshots and keystrokes of all users.

The WorkExaminer Professional console is used for administrative access to the server. Before access to the console is granted administrators must login. Internally, a custom protocol is used to call a respective stored procedure on the MSSQL database. The return value of the call is not validated on the server-side. Instead it is only validated client-side which allows to bypass authentication.

## CNA-Record (Kanon, cvelistV5)

- CNA: **SEC-VLab**
- State: PUBLISHED
- Stand: 2025-11-03 17:31:35

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-602** — Client-Side Enforcement of Server-Side Security
  The product includes a server that relies on the client to implement a protection mechanism that is intended to protect the server.

## Angriffsmuster (CAPEC)

- [CAPEC-21 — Exploitation of Trusted Identifiers](https://capec.mitre.org/data/definitions/21.html) _(Severity: High)_
- [CAPEC-31 — Accessing/Intercepting/Modifying HTTP Cookies](https://capec.mitre.org/data/definitions/31.html) _(Severity: High)_
- [CAPEC-162 — Manipulating Hidden Fields](https://capec.mitre.org/data/definitions/162.html) _(Severity: High)_
- [CAPEC-202 — Create Malicious Client](https://capec.mitre.org/data/definitions/202.html) _(Severity: Medium)_
- [CAPEC-207 — Removing Important Client Functionality](https://capec.mitre.org/data/definitions/207.html) _(Severity: High)_
- [CAPEC-208 — Removing/short-circuiting 'Purse' logic: removing/mutating 'cash' decrements](https://capec.mitre.org/data/definitions/208.html) _(Severity: Medium)_
- [CAPEC-383 — Harvesting Information via API Event Monitoring](https://capec.mitre.org/data/definitions/383.html) _(Severity: Low)_
- [CAPEC-384 — Application API Message Manipulation via Man-in-the-Middle](https://capec.mitre.org/data/definitions/384.html) _(Severity: Low)_

## ATT&CK-Techniken

- [T1134 — Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)
- [T1528 — Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)
- [T1539 — Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/)
- [T1056.004 — Input Capture: Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/)

## Referenzen

- <https://r.sec-consult.com/workexaminer>
- <http://seclists.org/fulldisclosure/2025/Oct/19>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-10640/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_