{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2025-1701 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2025-1701 yet. Limit exposure of the affected software until one is available.","what":"CVE-2025-1701 is a high-severity vulnerability in MIM Admin Service, published on 4 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-1701 and fix it if it is affected.\n\nWhat it is: CVE-2025-1701 is a high-severity vulnerability in MIM Admin Service, published on 4 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-1701 in the wild and no public exploit code.\n\nAffected product: MIM Admin Service. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-1701/ (Markdown: https://insights.sbomify.com/CVE-2025-1701/index.md)","id":"CVE-2025-1701","markdown":"https://insights.sbomify.com/CVE-2025-1701/index.md","name":"CVE-2025-1701","record":{"aliases":["GHSA-cqp2-7c4h-87f3"],"analysis":{"component_type":"desktop_application","fix_type":"upgrade","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"MIM Admin Service","requires_auth":"low_privilege","summary":"Local attackers can execute arbitrary code with MIM Admin service privileges via the RMI interface, requiring prior local access.","user_interaction":"not_required","vuln_class":"privilege_escalation"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"MIM","cpe":[],"cvss":{"score":8.9,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"},{"id":"CWE-20","name":"Improper Input Validation"}],"description":"CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a specially crafted request over the RMI interface to execute arbitrary code with the privileges of the MIM Admin service. The RMI interface is only accessible locally (listening on 127.0.0.1), limiting the attack vector to the local machine.  This means that in a properly configured hospital environment, an attacker must have already compromised the network and additionally compromised the system where the MIM Admin service is running.  From there, attackers with sufficient knowledge of MIM's implementation, library usage, and functionality with access to extend the MIM RMI library could force the MIM Admin service to run commands on the local machine with its privileges.\n\nUsers of MIM Software products exposed via RDP or multi-user application virtualization system should take note that the system being exposed is the environment hosting the virtualized MIM client.\n\nThis issue affects MIM Admin Service: before 7.2.13, 7.3.8, 7.4.3","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Local Privilege Escalation in MIM Admin Service","id":"CVE-2025-1701","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"privilege_escalation","year":"2025"},"n_packages":0,"n_references":1,"next":{"headline":"Ultimate Member \u003c= 2.10.0 - Unauthenticated SQL Injection via search Parameter","id":"CVE-2025-1702"},"packages":[],"prev":{"headline":"Privilege escalation in Software Fix","id":"CVE-2025-1700"},"products":["MIM Admin Service"],"published":"2025-06-04","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-06-04","vendors":["MIM Software"]},"summary":"Local attackers can execute arbitrary code with MIM Admin service privileges via the RMI interface, requiring prior local access.","url":"https://insights.sbomify.com/CVE-2025-1701/"}