Vulnerability details
CVE-2025-10941
Topaz SERVCore Teller
Topaz SERVCore Teller Installer SERVCoreTeller_2.0.40D.msi permission
CVSS 4.0
8.5High
Official description
A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1. Affected by this issue is some unknown functionality of the file SERVCoreTeller_2.0.40D.msi of the component Installer. Executing manipulation can lead to permission issues. The attack needs to be launched locally. You should upgrade the affected component. The vendor explains, that "this vulnerability was detected at the beginning of 2025, it was remediated because the latest published version of the installer no longer uses "nssm," which is responsible for this vulnerability".
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.5High | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X |
| 7.8High | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C |
| 7.8High | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C |
| 6.8Medium | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:L/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:OF/RC:C |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Topaz | SERVCore Teller | 2.14.0-RC2 | CVEProject cvelistV5 (CNA) |
| Topaz | SERVCore Teller | 2.14.1 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://vuldb.com/?id.325811 vdb-entrytechnical-description
- https://vuldb.com/?ctiid.325811 signaturepermissions-required
- https://vuldb.com/?submit.651434 third-party-advisory
- https://raw.githubusercontent.com/securityadvisories/Security-Advisories/refs/heads/main/Advisories/Blaze%20Information%20Security%20-%20Local%20Privilege%20Escalation%20via%20Insecure%20Directory%20Permissions%20in%20SERVCore%20Teller%20Installer.txt related
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-09-25
- Last updated
- 2025-09-30
- State
- Published
- Assigner (CNA)
- VulDB
Exploit prediction (EPSS)
0.14%
Probability of exploitation in 30 days
3.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-275Permission Issues
- CWE-266Incorrect Privilege Assignment