Vulnerability · Published Apr 3, 2026 · Assigned by airbus

CVE-2025-7024Local privilege escalation in Windows Server OS through installed Tetra Connectivity Server (TCS)

High 7.3

In plain English

A high-severity incorrect default permissions in TETRA Connectivity Server (TCS) from AIRBUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.1%top 96.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS allows Privilege Abuse. An attacker may execute arbitrary code with SYSTEM privileges if a user is tricked or directed to place a crafted file into the vulnerable directory. This issue affects TETRA connectivity Server: 7.0. Vulnerability fix is available and delivered to impacted customers.

Affected products (as reported)

Vendor	Product	Versions
AIRBUS	TETRA Connectivity Server (TCS)	7.0

Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://cwe.mitre.org/data/definitions/276.html