CVE-2025-58426
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
desknet's NEO versions V4.0R1.0 to V9.0R2.0 contain a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications.
Risk Assessment
The hard-coded cryptographic key can be exploited to create malicious applications, potentially leading to unauthorized access or code execution. The risk is high due to possible privilege escalation.
Recommendation
Update desknet's NEO to a version later than V9.0R2.0 if available, or contact the vendor for a patch. Consider rotating cryptographic keys and monitoring for unusual AppSuite applications.
Other vulnerabilities in desknet's NEO
See all- CVE-2025-58079Medium
In desknet's NEO V4.0R1.0 to V9.0R2.0, there is an Improper Protection of Alternate Path (CWE-424) vulnerability in the AppSuite that allows an attacker to create malicious AppSuite applications.
- CVE-2025-55072Medium
In desknet's NEO V2.0R1.0 to V9.0R2.0, there is a Stored Cross-Site Scripting (XSS) vulnerability that allows execution of arbitrary JavaScript in a user's web browser.
- CVE-2025-54859Medium
In desknet's NEO V9.0R2.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability that allows execution of arbitrary JavaScript in a user's web browser.
- CVE-2025-54760Medium
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allows execution of arbitrary JavaScript in a user's web browser. The malicious script is persistently stored and executed when the infected page is viewed.
- CVE-2025-24833Medium
Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allows execution of arbitrary JavaScript in a user's web browser. The malicious script is persistently stored and executed when the infected page is viewed.
Original NVD description (English source)
desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS