CVE-2025-14095

Privilege boundary violation in Radiometer Products

View on CVE.org
Published Dec 17, 2025 CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Description
A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software. 

Other related CVE's are CVE-2025-14096 & CVE-2025-14097.

Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency.

Required configuration for Exposure:


Physical access to the analyzer is needed.

Temporary work Around:


Only authorized people can physically access the analyzer.

Permanent solution:
Local Radiometer representatives will contact all affected customers to discuss a permanent solution.



Exploit Status:
Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication.                                                                                                                                                                                        Note:

CVSS score 6.8 when underlying OS is Windows 7 or Windows XP Operating systems and CVSS score 5.7 when underlying OS is Windows 8 or Windows 10 operating systems.

Remediation

Vendor Solution

Local Radiometer representatives will contact all affected customers to discuss a permanent solution.

Vendor Workaround

Only authorized people can physically access the analyzer.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References
Link Providers
https://www.radiometer.com/myradiometer cve-icon cve-icon
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
Radiometer
Radiometer abl800 Basic Analyzer
Radiometer abl800 Flex Analyzer
Radiometer abl90 Flex Analyzer
Radiometer abl90 Flex Plus Analyzer
Radiometer abl9 Analyzer
Radiometer aqt90 Flex Analyzer
Vendors & Products Microsoft
Microsoft windows
Radiometer
Radiometer abl800 Basic Analyzer
Radiometer abl800 Flex Analyzer
Radiometer abl90 Flex Analyzer
Radiometer abl90 Flex Plus Analyzer
Radiometer abl9 Analyzer
Radiometer aqt90 Flex Analyzer
Type Values Removed Values Added
Description A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.  Other related CVE's are CVE-2025-14096 & CVE-2025-14097. Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency. Required configuration for Exposure: Physical access to the analyzer is needed. Temporary work Around: Only authorized people can physically access the analyzer. Permanent solution: Local Radiometer representatives will contact all affected customers to discuss a permanent solution. Exploit Status: Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication. A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.  Other related CVE's are CVE-2025-14096 & CVE-2025-14097. Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency. Required configuration for Exposure: Physical access to the analyzer is needed. Temporary work Around: Only authorized people can physically access the analyzer. Permanent solution: Local Radiometer representatives will contact all affected customers to discuss a permanent solution. Exploit Status: Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication.                                                                                                                                                                                        Note: CVSS score 6.8 when underlying OS is Windows 7 or Windows XP Operating systems and CVSS score 5.7 when underlying OS is Windows 8 or Windows 10 operating systems.
Type Values Removed Values Added
Description A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.  Other related CVE's are CVE-2025-14096 & CVE-2025-14097. Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency. Required configuration for Exposure: Physical access to the analyzer is needed Temporary work Around: Only authorized people can physically access the analyzer. Permanent solution: Local Radiometer representatives will contact all affected customers to discuss a permanent solution. Exploit Status: Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication. A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.  Other related CVE's are CVE-2025-14096 & CVE-2025-14097. Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency. Required configuration for Exposure: Physical access to the analyzer is needed. Temporary work Around: Only authorized people can physically access the analyzer. Permanent solution: Local Radiometer representatives will contact all affected customers to discuss a permanent solution. Exploit Status: Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication.
Type Values Removed Values Added
Description A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.                                                                                                                                                                                          Other related CVE's are CVE-2025-14096 and CVE-2025-14097.                                                                                           Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency.                   Required configuration for Exposure: Physical access to the analyzer is needed.                                                                         Temporary work Around:Only authorized people can physically access the analyzer.                                                         Permanent solution: Local Radiometer representatives will contact all affected customers to discuss a permanent solution. Exploitation status: Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication. A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.  Other related CVE's are CVE-2025-14096 & CVE-2025-14097. Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency. Required configuration for Exposure: Physical access to the analyzer is needed Temporary work Around: Only authorized people can physically access the analyzer. Permanent solution: Local Radiometer representatives will contact all affected customers to discuss a permanent solution. Exploit Status: Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication.
Type Values Removed Values Added
Description A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.                                                                                                                                                                                              Other related CVE's are CVE-2025-14096 and CVE-2025-14097.                                                                                                                                                                                                                                                                                                   Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency.                   Required configuration for Exposure: Physical access to the analyzer is needed.                                                                         Temporary work Around:Only authorized people can physically access the analyzer.                                                         Permanent solution: Local Radiometer representatives will contact all affected customers to discuss a permanent solution.                                     Exploit Status:                                                                                                                                                                                                                                                                                                                                                                                       Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication. A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.                                                                                                                                                                                          Other related CVE's are CVE-2025-14096 and CVE-2025-14097.                                                                                           Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency.                   Required configuration for Exposure: Physical access to the analyzer is needed.                                                                         Temporary work Around:Only authorized people can physically access the analyzer.                                                         Permanent solution: Local Radiometer representatives will contact all affected customers to discuss a permanent solution. Exploitation status: Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication.
Type Values Removed Values Added
Description A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.                                                                                                                                                                                              Other related CVE's are CVE-2025-14096 and CVE-2025-14097.                                                                                                                                                                                                                                                                                                   Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency. Required configuration for Exposure:  Physical access to the analyzer is needed. Temporary work Around:                                                                                                                                                                                                                                                                                                                                                                       Only authorized people can physically access the analyzer. Permanent solution: Local Radiometer representatives will contact all affected customers to discuss a permanent solution. Exploit Status:                                                                                                                                                                                                                                                                                                                                                                                       Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication. A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.                                                                                                                                                                                              Other related CVE's are CVE-2025-14096 and CVE-2025-14097.                                                                                                                                                                                                                                                                                                   Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency.                   Required configuration for Exposure: Physical access to the analyzer is needed.                                                                         Temporary work Around:Only authorized people can physically access the analyzer.                                                         Permanent solution: Local Radiometer representatives will contact all affected customers to discuss a permanent solution.                                     Exploit Status:                                                                                                                                                                                                                                                                                                                                                                                       Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication.
Type Values Removed Values Added
Description A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.                                                                                                                                                                                              Other related CVE's are CVE-2025-14096 and CVE-2025-14097.                                                                                                                                                                                                                                                                                                   Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency. Required configuration for Exposure:  Physical access to the analyzer is needed. Temporary work Around:                                                                                                                                                                                                                                                                                                                                                                       Only authorized people can physically access the analyzer. Permanent solution: Local Radiometer representatives will contact all affected customers to discuss a permanent solution. Exploit Status:                                                                                                                                                                                                                                                                                                                                                                                       Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication.
Title Privilege boundary violation in Radiometer Products
Weaknesses CWE-284
CWE-693
References
Metrics cvssV3_1

{'score': 5.7, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'}
Earlier changes (3)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Radiometer
Published
Updated
Dec 17, 2025, 9:46 PM
Reserved
Dec 5, 2025, 10:49 AM

View source JSON

Updated
Dec 17, 2025, 9:46 PM

JSON

Status
Deferred
Published
Dec 17, 2025, 12:15 PM
Modified
Oct 7, 2026, 11:10 AM

View source JSON

No data.

Updated
Dec 17, 2025, 9:18 PM

JSON