CVE-2025-62625

Improper privilege management in KVM key download allowing token swapping and key theft

Published May 14, 2026 CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Description
Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in unauthorized access to privileged resources and loss of confidentiality.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Improper privilege management in KVM key download allowing token swapping and key theft
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in unauthorized access to privileged resources and loss of confidentiality.
Weaknesses CWE-269
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
AMD
Published
Updated
May 14, 2026, 3:35 PM
Reserved
Oct 16, 2025, 8:46 PM
Status
Awaiting Analysis
Published
May 14, 2026, 3:16 PM
Modified
Jun 17, 2026, 9:52 AM