Summary of CVE-2025-2098
CVE Identifier: CVE-2025-2098
Publication Date: March 26, 2025
Vendor: Beijing Honghu Yuntu Technology
Product: Fast CAD Reader
Vulnerable Versions: All versions since 4.1.5
Vulnerability Type (CWE): Improper Privilege Assignment (CWE-266)
Reporting Source: Reported to CERT Polska
Overview of the Vulnerability
CERT Polska has issued a report on a significant vulnerability associated with the Fast CAD Reader application developed by Beijing Honghu Yuntu Technology. This vulnerability, identified as CVE-2025-2098, was discovered during the evaluation of the application running on MacOS. It pertains to improper file permissions assigned during the installation process of the Fast CAD Reader.
Nature of the Vulnerability
The Fast CAD Reader application was found to have file permissions set to RWXRWXRWX, which deviates from the standard security practices for applications on the MacOS operating system. MacOS typically demands that applications have permissions set to DRWXR-XR-X for adequate security and protection against unauthorized access or control.
This misconfiguration allows for the exploitation of the application through Dylib hijacking, where the vulnerabilities can be leveraged by guest accounts, other users, and even malicious applications to escalate their privileges within the system.
Affected Versions
The identification of the vulnerability suggests that it impacts all versions of the Fast CAD Reader, especially since the vendor, Beijing Honghu Yuntu Technology, has not responded to queries regarding the issue. The specific version tested that exhibited this vulnerability was 4.1.5.
Recognition for Responsible Reporting
CERT Polska acknowledges a contribution from Karol Mazurek of Afine for responsibly reporting this vulnerability. This assistance was pivotal in the coordination of the disclosure and potentially preventing exploitation in the wild before a public announcement was made.
Closing Remarks
The existence of CVE-2025-2098 highlights critical issues surrounding the management of application permissions, underscoring the necessity for developers to adhere to established security protocols during application installations. Users of the Fast CAD Reader should remain vigilant and consider applying any available updates, as well as practicing enhanced security measures on their systems, particularly if they are using versions vulnerable to this identified issue. The ongoing coordination of vulnerability disclosures by organisations like CERT Polska plays a crucial role in promoting software security and protecting against potential exploits.
Furthermore, for more details on the coordinated vulnerability disclosure process, interested parties can find additional resources at CERT Polska’s website: https://cert.pl/en/cvd/.