CVE-2025-2297

Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.

Score

CVSS 3.1 7.8 High

Status

Analyzed - 13061848-ea10-403d-bd75-c83a022c2891

Published

2025-07-28

Last modified

2025-07-28

Weaknesses

CWE-268

Affected products

• Privilege Management For Windows (Beyondtrust)

References

• https://www.beyondtrust.com/trust-center/security-advisories/bt25-05