CVE-2025-10644

CriticalCVSS 9.4

Published: 17/09/2025(UTC)Updated: 26/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

3.00%

87th percentile - higher than 87% of all known CVEs

Summary

A vulnerability in Wondershare Repairit allows remote attackers to bypass authentication due to incorrect permission assignment on an SAS token. Authentication is not required, and an attacker can launch a supply-chain attack and execute arbitrary code on customers' endpoints.

Risk Assessment

Organizations using Wondershare Repairit may be exposed to a supply-chain attack leading to arbitrary code execution on endpoints, potentially resulting in full system compromise.

Recommendation

Immediately update Wondershare Repairit to a patched version and verify that no unauthorized access to SAS tokens or storage resources has occurred.

Other vulnerabilities in Wondershare Repairit

CVE-2025-10643Critical
A vulnerability in Wondershare Repairit allows remote attackers to bypass authentication due to incorrect permission assignment on a storage account token. Exploitation does not require authentication.

Original NVD description (English source)

Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on Wondershare Repairit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the permissions granted to an SAS token. An attacker can leverage this vulnerability to launch a supply-chain attack and execute arbitrary code on customers' endpoints. Was ZDI-CAN-26892.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS