CVE-2025-43720

State: Published
Severity: 6.5 Medium
Published: Jul 21, 2025
Updated: Jul 22, 2025
Reserved: Apr 17, 2025

Description

Headwind MDM before 5.33.1 makes configuration details accessible to unauthorized users. The Configuration profile is exposed to the Observer user role, revealing the password requires to escape out of the MDM controlled device's profile.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/h-mdm/hmdm-server/commit/19e4a63f732c99064444df7e8c61b4f01df362e8
https://github.com/h-mdm/hmdm-server/compare/v5.32.1...v5.33.1
https://www.periculo.co.uk/cyber-security-blog/how-our-pen-tester-found-a-critical-vulnerability-cve-2025-43720

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.