CVE-2025-58079
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In desknet's NEO V4.0R1.0 to V9.0R2.0, there is an Improper Protection of Alternate Path (CWE-424) vulnerability in the AppSuite that allows an attacker to create malicious AppSuite applications.
Risk Assessment
An attacker could create malicious applications, potentially leading to unauthorized actions or security breaches.
Recommendation
Upgrade desknet's NEO to a version newer than V9.0R2.0 if available, or apply security patches.
Other vulnerabilities in desknet's NEO
See all- CVE-2025-58426Medium
desknet's NEO versions V4.0R1.0 to V9.0R2.0 contain a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications.
- CVE-2025-55072Medium
In desknet's NEO V2.0R1.0 to V9.0R2.0, there is a Stored Cross-Site Scripting (XSS) vulnerability that allows execution of arbitrary JavaScript in a user's web browser.
- CVE-2025-54859Medium
In desknet's NEO V9.0R2.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability that allows execution of arbitrary JavaScript in a user's web browser.
- CVE-2025-54760Medium
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allows execution of arbitrary JavaScript in a user's web browser. The malicious script is persistently stored and executed when the infected page is viewed.
- CVE-2025-24833Medium
Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allows execution of arbitrary JavaScript in a user's web browser. The malicious script is persistently stored and executed when the infected page is viewed.
Original NVD description (English source)
Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applications.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS