Listen to this Post
How the CVE Works
CVE-2025-54394 affects Netwrix Directory Manager (formerly Imanami GroupID) versions 11.0.0.0 to 11.1.25162.02. The vulnerability arises due to insufficient protection of credentials when the software processes requests to remote Excel resources. Attackers can intercept or manipulate these credentials due to weak encryption or improper storage, leading to unauthorized access. The flaw allows threat actors to exploit exposed authentication data, potentially compromising sensitive directory information.
DailyCVE Form
Platform: Netwrix Directory Manager
Version: 11.0.0.0 – 11.1.25162.02
Vulnerability: Credential Exposure
Severity: Critical
Date: 08/11/2025
Prediction: Patch by 09/15/2025
What Undercode Say
Check exposed credentials in logs grep "ExcelAuth" /var/log/netwrix/logfile Verify encryption status openssl enc -d -aes-256-cbc -in config.enc Test remote resource access curl -X POST http://<target>/excel_export --data "credentials=leaked"
How Exploit
- Intercept unencrypted credentials via MITM.
- Extract stored credentials from memory dumps.
- Forge requests using stolen credentials.
Protection from this CVE
- Update to version 11.1.25162.03+.
- Disable remote Excel resource access.
- Enforce TLS for all transmissions.
Impact
- Unauthorized directory access.
- Data exfiltration.
- Privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
