CVE-2025-25709

Root

Cause CVE-2025-25709 is a privilege escalation vulnerability in dtp.ae tNexus Airport View version 2.8. The application fails to properly enforce authorization checks on the addUser and updateUser endpoints, allowing an authenticated user with low privileges to create new accounts or modify existing user records. By crafting specific POST requests to these endpoints, an attacker can assign administrative group membership to a user they control [1].

Exploitation

The attack is carried out remotely by an authenticated attacker who already possesses a valid session with normal user privileges. No additional authentication or network position is required beyond that initial access. The attacker sends specially crafted HTTP POST requests to the vulnerable endpoints, which do not verify that the requesting user has the rights to change group assignments or create users with elevated roles [1].

Impact

Successful exploitation grants the attacker full administrative control over the tNexus Airport View application. This can lead to unauthorized modification of airport display configurations, access to sensitive data handled by the system, and potential further compromise of connected infrastructure. The vulnerability has a CVSS v3 base score of 7.5 (High), reflecting the severe confidentiality, integrity, and availability impact [1].

Mitigation

The vendor, dtp.ae, has addressed the vulnerability in a later version of tNexus Airport View. Users are strongly advised to upgrade to the latest available release. If an immediate update is not possible, additional access controls and monitoring mechanisms should be implemented to detect unauthorized privilege escalation attempts [1].