CVE-2025-54341
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Hard-coded configuration values exist in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. This may lead to disclosure of sensitive information or facilitate exploitation by attackers.
Risk Assessment
Hard-coded configuration data can be used by attackers to gain unauthorized access or bypass security mechanisms. It poses a risk to system confidentiality and integrity.
Recommendation
Remove hard-coded configuration values and replace them with a secure configuration management mechanism. Update the software to a version free of the vulnerability.
Other vulnerabilities in Desktop Alert PingAlert
See all- CVE-2025-54347Critical
In Application Server of Desktop Alert PingAlert (versions 6.1.0.11 to 6.1.1.2), a Directory Traversal vulnerability allows an attacker to write arbitrary files under certain conditions.
- CVE-2025-54343Critical
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for Escalation of Privileges.
- CVE-2025-54339Critical
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. It is remotely exploitable for escalation of privileges.
- CVE-2025-54563High
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Incorrect Access Control, leading to Remote Information Disclosure.
- CVE-2025-54338High
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to disclose user hashes.
- CVE-2025-54562Medium
A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows technical information to be disclosed through stack traces.
- CVE-2025-54561Medium
An Incorrect Access Control vulnerability in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2 allows remote access to content without proper permissions due to a Broken Authorization Schema.
- CVE-2025-54560Low
A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. It allows probing of internal infrastructure.
- CVE-2025-54559Low
An issue was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2 that allows remote Path Traversal for loading arbitrary external content. An attacker could read or load files outside the intended directory.
- CVE-2025-54348Medium
A Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. It allows an attacker to hijack a user's browser and capture sensitive information.
Original NVD description (English source)
A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Hard-coded configuration values.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS