CVE-2025-15553

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15553", "assignerOrgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "state": "PUBLISHED", "assignerShortName": "NCSC-FI", "dateReserved": "2026-02-02T05:56:43.336Z", "datePublished": "2026-03-16T10:45:04.206Z", "dateUpdated": "2026-03-16T18:01:00.996Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "shortName": "NCSC-FI", "dateUpdated": "2026-03-16T10:45:04.206Z"}, "title": "Insecure Logout Functionality in Truesec LAPSWebUI", "datePublic": "2026-03-16T12:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-613", "description": "CWE-613 Insufficient session expiration", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Escalation of Privileges"}]}, {"descriptions": [{"lang": "en", "value": "Information Disclosure"}]}], "affected": [{"vendor": "Truesec", "product": "LAPSWebUI", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4", "versionType": "maven"}, {"status": "unaffected", "version": "2.4", "versionType": "maven"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Non-working logout functionality in Truesec\u2019s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Non-working logout functionality in Truesec\u2019s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password."}]}], "references": [{"url": "https://labs.reversec.com/advisories/2026/03/insecure-logout-functionality-in-truesec-lapswebui"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H"}}], "workarounds": [{"lang": "en", "value": "Configure LAPSWebUI to require Entra ID sign-in every time a user wants to display a password, by enabling the setting Force Reauth on Password request.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Configure LAPSWebUI to require Entra ID sign-in every time a user wants to display a password, by enabling the setting <i>Force Reauth on Password request</i>."}]}], "credits": [{"lang": "en", "value": "Laban Sk\u00f6llermark at Reversec Sweden AB", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T17:54:04.446231Z", "id": "CVE-2025-15553", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T18:01:00.996Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15553", "assignerOrgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "state": "PUBLISHED", "assignerShortName": "NCSC-FI", "dateReserved": "2026-02-02T05:56:43.336Z", "datePublished": "2026-03-16T10:45:04.206Z", "dateUpdated": "2026-03-16T18:01:00.996Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "shortName": "NCSC-FI", "dateUpdated": "2026-03-16T10:45:04.206Z"}, "title": "Insecure Logout Functionality in Truesec LAPSWebUI", "datePublic": "2026-03-16T12:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-613", "description": "CWE-613 Insufficient session expiration", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Escalation of Privileges"}]}, {"descriptions": [{"lang": "en", "value": "Information Disclosure"}]}], "affected": [{"vendor": "Truesec", "product": "LAPSWebUI", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4", "versionType": "maven"}, {"status": "unaffected", "version": "2.4", "versionType": "maven"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Non-working logout functionality in Truesec\u2019s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Non-working logout functionality in Truesec\u2019s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password."}]}], "references": [{"url": "https://labs.reversec.com/advisories/2026/03/insecure-logout-functionality-in-truesec-lapswebui"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H"}}], "workarounds": [{"lang": "en", "value": "Configure LAPSWebUI to require Entra ID sign-in every time a user wants to display a password, by enabling the setting Force Reauth on Password request.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Configure LAPSWebUI to require Entra ID sign-in every time a user wants to display a password, by enabling the setting <i>Force Reauth on Password request</i>."}]}], "credits": [{"lang": "en", "value": "Laban Sk\u00f6llermark at Reversec Sweden AB", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15553", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T17:54:04.446231Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T17:56:24.909Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LAPSWebUI", "vendor": "Truesec", "versions": [{"lessThan": "2.4", "status": "affected", "version": "0", "versionType": "maven"}, {"status": "unaffected", "version": "2.4", "versionType": "maven"}]}], "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:truesec:lapswebui:*:*:*:*:*:*:*:*", "matchCriteriaId": "52616015-9CF6-4732-B4F7-A4246D3DE157", "versionEndExcluding": "2.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Non-working logout functionality in Truesec\u2019s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password."}, {"lang": "es", "value": "La funcionalidad de cierre de sesi\u00f3n no operativa en LAPSWebUI de Truesec antes de la versi\u00f3n 2.4 permite a un atacante con acceso a una estaci\u00f3n de trabajo escalar sus privilegios mediante la divulgaci\u00f3n de la contrase\u00f1a de administrador local."}], "id": "CVE-2025-15553", "lastModified": "2026-06-17T08:38:00.660", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15553", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T17:54:04.446231Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:17:56.280", "references": [{"source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "tags": ["Third Party Advisory"], "url": "https://labs.reversec.com/advisories/2026/03/insecure-logout-functionality-in-truesec-lapswebui"}], "sourceIdentifier": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "2.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "LAPSWebUI", "source": "cna", "vendor": "Truesec"}, "product": "lapswebui", "vendor": "truesec"}], "analysis": {"en": {"generated_at": "2026-03-22T14:46:47.041869+00:00", "value": {"mitigation_remediation": ["Enable Force Reauth on Password request in LAPSWebUI to require Entra\u202fID sign\u2011in each time a password is requested.", "Upgrade Truesec LAPSWebUI to version\u202f2.4 or later where the logout functionality is corrected.", "Restrict workstation access to prevent unauthorized users from gaining session data, and enforce strict least\u2011privilege policies for local accounts."], "summary": {"action": "Apply Workaround", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected product is Truesec LAPSWebUI, any release before v2.4. Administrators running versions earlier than 2.4 should be aware that a session can still carry valid local administrator credentials after a user logs out. The vendor recommends enabling the Force\u202fReauth on Password request setting to enforce re\u2011authentication with Entra\u202fID whenever a password is displayed, thereby limiting the window during which the credentials are available.", "description_and_impact": "The vulnerability stems from a non\u2011functional logout feature in Truesec\u2019s LAPSWebUI prior to version\u202f2.4. Because the logout does not invalidate the session, local admin credentials remain exposed for any user who has access to a workstation running the application. An attacker can acquire the local administrator password from the session, enabling them to raise their privileges on that system. This weakness is classified as a priority three credential disclosure and aligns with CWE\u2011613.", "risk_and_exploitability": "The CVSS score for this issue is 6, indicating moderate severity, and the EPSS score is below 1\u202f%, suggesting that exploitation is unlikely but still possible if an attacker has local access. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local workstation user who has logged into LAPSWebUI; the exploit requires no network access and would be easiest where users are permitted to remain logged in for extended periods."}}}}, "created": "2026-03-24T10:45:03.696335+00:00", "updated": "2026-03-30T07:02:50.891303+00:00", "vendors": ["truesec", "truesec$PRODUCT$lapswebui"]}