CVE-2025-50675
7.8GPMAW · GPMAW
GPMAW 14 contains insecure directory permissions, allowing unprivileged users to replace executables, leading to local privilege escalation when an administrator executes the software uninstaller.
Executive summary
GPMAW 14 suffers from a local privilege escalation vulnerability due to insecure installation directory permissions that allow unprivileged users to execute arbitrary code with administrative rights.
Vulnerability
The application installation directory is configured with excessive read, write, and execute permissions for all users, which allows an unprivileged local attacker to replace the uninstaller executable with a malicious file. When an administrator subsequently runs the uninstaller, the malicious code executes with elevated privileges.
Business impact
Successful exploitation allows a low-privileged user to achieve full administrative control over the affected system. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to complete system compromise, unauthorized data access, and the potential for lateral movement across the internal network.
Remediation
Immediate Action: Restrict directory permissions to the minimum necessary level for the installation folder and monitor vendor channels for an official security patch. If no patch is available, consider moving the software to a directory with restricted access or limiting usage to non-production environments.
Proactive Monitoring: Audit file system access logs for unauthorized modifications to executable files within the GPMAW directory and monitor for unexpected process creation events originating from the uninstaller.
Compensating Controls: Implement strict Endpoint Detection and Response (EDR) policies to alert on unauthorized modifications to executable binaries and restrict standard user access to installation directories where possible.
Exploitation status
Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (LukeSec/CVE-2025-50675-GPMAW-Permissions).
Analyst recommendation
The risk posed by this vulnerability is significant due to the potential for privilege escalation. Administrators should immediately restrict filesystem permissions on the affected directory to prevent unauthorized modification of binaries and prioritize the application of vendor-supplied updates as soon as they are released.