CVE-2025-40548
CriticalSummary
Serv-U contains a missing validation process vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as medium because services frequently run under less-privileged service accounts by default.
Risk Assessment
An attacker with admin privileges could execute code, potentially leading to privilege escalation or full system compromise.
Recommendation
It is recommended to restrict administrative privileges, monitor administrator activities, and apply available vendor patches.
Original NVD description (English source)
A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.