CVE-2025-4539
Hainan ToDesk DLL File Parser profapi.dll uncontrolled search path
- State
- Published
- Severity
- 7.3 High
- Published
- May 11, 2025
- Updated
- May 12, 2025
- Reserved
- May 10, 2025
Description
A vulnerability was found in Hainan ToDesk 4.7.6.3. It has been declared as critical. This vulnerability affects unknown code in the library profapi.dll of the component DLL File Parser. The manipulation leads to uncontrolled search path. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.3 High | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 7.0 High | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | VulDB |
| 3.0 | 7.0 High | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | VulDB |
| 2.0 | 6.0 Medium | AV:L/AC:H/Au:S/C:C/I:C/A:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ToDeskHainan |
|
References
- VDB-308284 | Hainan ToDesk DLL File Parser profapi.dll uncontrolled search pathvdb-entry
- VDB-308284 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #566698 | Hainan Interesting Technology Co., Ltd todesk 4.7.6.3 privilege escalationthird-party-advisory
- https://www.yuque.com/ba1ma0-an29k/nnxoap/dgxzuhd90e19grpg?singleDocbroken-linkexploit
- https://www.yuque.com/ba1ma0-an29k/nnxoap/dgxzuhd90e19grpg?singleDoc#%20%E3%80%8Atodesk%20program%20has%20a%20privilege%20escalation%20vulnerability%E3%80%8Bexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.