Vulnerability · Published Feb 12, 2025 · Assigned by ProgressSoftware
CVE-2025-0556Telerik Report Server Clear Text Transmission of Agent Commands
High 8.8
In plain English
A high-severity security flaw in Telerik Report Server from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 76.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent process and app host process occurs over an unencrypted tunnel, which can be subjected to local network traffic sniffing.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | Telerik Report Server | 1.0.0 – before 2025 Q1 (11.0.25.211) |
Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H