CVE-2025-55320 is an SQL injection vulnerability in Microsoft Configuration Manager (versions 2403, 2409, and 2503) that allows an authorized attacker to elevate privileges over an adjacent network. With a CVSS score of 6.8 (Medium), this vulnerability has a low attack complexity and can lead to high impact on confidentiality, integrity, and availability. There is no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not currently listed in the KEV catalog, indicating no active exploitation. However, it has garnered significant community discussion and media coverage, suggesting awareness within the cybersecurity community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.00.9128.1035CPE matchmatch criteria | cpe:2.3:a:microsoft:configuration_manager_2403:*:*:*:*:*:*:*:* | ||
< 5.00.9132.1029CPE matchmatch criteria | cpe:2.3:a:microsoft:configuration_manager_2409:*:*:*:*:*:*:*:* | ||
< 5.00.9135.1008CPE matchmatch criteria | cpe:2.3:a:microsoft:configuration_manager_2503:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.