Vulnerability · Published Apr 1, 2025 · Assigned by NCSC-FI
CVE-2025-0416Valmet DNA Local privilege escalation through insecure DCOM configuration
High 8.9
In plain English
A high-severity security flaw in Valmet DNA from Valmet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions that allow it to run commands as a user with the SeImpersonatePrivilege privilege. The SeImpersonatePrivilege privilege is a Windows permission that allows a process to impersonate another user. An attacker can use this vulnerability to escalate their privileges and take complete control of the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Valmet | Valmet DNA | C2007 – through C2022 |
Weakness: CWE-250 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:D/RE:H/U:Amber