CVE-2025-27582

CVE-2025-27582 describes a local privilege escalation vulnerability in One Identity Password Manager before version 5.14.4. A flawed security hardening mechanism in the kiosk browser, intended to restrict privileged actions, can be bypassed by an attacker accessing the Password Self-Service site from the lock screen and navigating to a malicious webpage via the Help function. This allows the attacker to restore and invoke the window.print() function, leading to a SYSTEM-privileged print dialog that can be leveraged to spawn a command prompt with SYSTEM privileges. This vulnerability is rated High severity (CVSS 7.6) due to its potential for complete compromise of the affected device (C:H/I:H/A:H) with low attack complexity (AC:L) and no user interaction required (UI:N) once the initial access to a locked workstation is achieved. The attack vector is physical/local (AV:P), as it requires access to the locked workstation. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, which is typical for the majority of reported vulnerabilities.