Threat Advisory

Critical Flaws Found in nGeniusONE Monitoring Platform

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High

EXECUTIVE SUMMARY:

An advisory has been released highlighting multiple security vulnerabilities impacting an infrastructure monitoring platform used across cloud, data center, and remote environments. These vulnerabilities include unauthorized file access, hardcoded credentials, stored XSS flaws, information disclosure, broken authorization, insecure file permissions, weak sudo configurations, and arbitrary file creation. Exploiting these issues could allow attackers to gain unauthorized access, escalate privileges, or execute malicious scripts within critical infrastructure. Users are urged to upgrade to the latest build and review their systems for potential signs of exploitation.

 

  • CVE-2025-32986: Sensitive file exposure with a CVSS score of 8.6 that allows attackers to access files without authentication.

 

  • CVE-2025-32985: Hardcoded credential exposure with a CVSS score of 8.1 that allows extraction of credentials from JAR files.

 

  • CVE-2025-32984: Stored Cross-Site Scripting (XSS) with a CVSS score of 7.4 that allows attackers to inject malicious scripts via POST parameters.

 

  • CVE-2025-32983: Information disclosure with a CVSS score of 6.5 that reveals technical details through stack errors.

 

  • CVE-2025-32982: Broken authorization schema with a CVSS score of 8.8 that allows unauthorized access within the reporting module.

 

  • CVE-2025-32981: Insecure file permissions with a CVSS score of 7.8 that enable local privilege escalation through the CLI file.

 

  • CVE-2025-32980: Weak sudo configuration with a CVSS score of 7.1 that permits potential misuse of administrative privileges.

 

  • CVE-2025-32979: Arbitrary file creation with a CVSS score of 7.6 that allows attackers to create unauthorized files.

 

Upgrading to the latest build is essential to address these vulnerabilities. Additionally, conducting thorough system audits can help identify any signs of exploitation.

RECOMMENDATION:

  • We strongly recommend you update nGeniusONE to build version 6.4.0 b2350 or later.

REFERENCES:

The following reports contain further technical details:

crossmenu