BeyondTrust Privilege Management for Windows < 25.4.270.0 Multiple Vulnerabilities (BT25-05) (BTS25-06)

high Nessus Plugin ID 246414

Language:

Synopsis

The remote host is missing a security update.

Description

The version of BeyondTrust Privilege Management for Windows installed on the remote host is prior to 25.4.270.0. It is, therefore, affected by multiple vulnerabilities as referenced in the BT25-05 and BT25-06 advisories:

- Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator. (CVE-2025-2297)

- Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions. (CVE-2025-6250)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to BeyondTrust Privilege Management for Windows version 25.4.270.0 or later.

Plugin Details

Severity: High

ID: 246414

File Name: beyondtrust_privilege_management_BT25-05_BT25-06.nasl

Version: 1.1

Type: local

Agent: windows

Family: Windows

Published: 8/8/2025

Updated: 8/8/2025

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2025-2297

CVSS v3

Risk Factor: High

Base Score: 7.1

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS v4

Risk Factor: High

Base Score: 7.2

Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/a:beyondtrust:privilege_management_for_windows

Required KB Items: installed_sw/BeyondTrust Privilege Management for Windows

Patch Publication Date: 7/28/2025

Vulnerability Publication Date: 7/28/2025

Reference Information

CVE: CVE-2025-2297, CVE-2025-6250

IAVA: 2025-A-0564

Detections

Analytics