CVE-2025-2297 — Privilege Management for Windows - Elevation of Privilege

CVE-2025-2297

Privilege Management for Windows - Elevation of Privilege PUBLISHED

Description (CNA)

Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.

Affected (CNA)

Vendor / product	Versions
BeyondTrust / Privilege Management for Windows	affected 0 before <25.4.270

CWE

CWE-268

References

https://www.beyondtrust.com/trust-center/security-advisories/bt25-05

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.