The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain remote code execution as NT Authority\SYSTEM on the server by exchanging accessible service binaries in the WorkExaminer installation directory (e.g. "C:\Program File (x86)\Work Examiner Professional Server").
References
| Link | Resource |
|---|---|
| https://r.sec-consult.com/workexaminer |
Configurations
No configuration.
History
22 Oct 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
21 Oct 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-21 12:15
Updated : 2025-10-22 19:15
NVD link : CVE-2025-10639
Mitre link : CVE-2025-10639
CVE.ORG link : CVE-2025-10639
JSON object : View
Products Affected
No product.
CWE
CWE-798
Use of Hard-coded Credentials