CVE-2025-10639 Usage of Hardcoded FTP Credentials EfficientLab WorkExaminer Professional
Attackers can use hardcoded FTP credentials to read, modify data, and execute code as SYSTEM on the WorkExaminer Professional server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-10639?
CVE-2025-10639 is a high-severity vulnerability in EfficientLab WorkExaminer Professional, published on 21 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain remote code execution as NT Authority\SYSTEM on the server by exchanging accessible service binaries in the WorkExaminer installation directory (e.g. "C:\Program File (x86)\Work Examiner Professional Server").
Weakness: CWE-798
Which versions are affected by CVE-2025-10639?
How do I fix CVE-2025-10639?
No fix has been published for CVE-2025-10639 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-10639 being exploited?
There is no known exploitation of CVE-2025-10639 in the wild and no public exploit code.
Sources
Also known as GHSA-78gv-jfcm-9w8v.