Vulnerability · Published Oct 21, 2025 · Assigned by SEC-VLab

CVE-2025-10639Usage of Hardcoded FTP Credentials EfficientLab WorkExaminer Professional

High 8.8

In plain English

A high-severity hard-coded credentials in WorkExaminer Professional from EfficientLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.9%top 39.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain remote code execution as NT Authority\SYSTEM on the server by exchanging accessible service binaries in the WorkExaminer installation directory (e.g. "C:\Program File (x86)\Work Examiner Professional Server").

Affected products (as reported)

Vendor	Product	Versions
EfficientLab	WorkExaminer Professional	<= 4.0.0.52001

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://r.sec-consult.com/workexaminer third-party-advisory
http://seclists.org/fulldisclosure/2025/Oct/19