CVE-2025-31144

Published Apr 27, 2025 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, a remote unauthenticated attacker may attempt to log in to an arbitrary host via Windows system where the product is running.

Analysis

No analysis available yet

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

SIOS Technology, Inc.

Quick Agent V3

affected

Version	Status	Constraints
`prior to Ver3.2.1`	affected	—

SIOS Technology, Inc.

Quick Agent V2

affected

Version	Status	Constraints
`prior to Ver2.9.8`	affected	—

No data.

No data available yet.

Remediation

No remediation available yet

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-12419	Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, a remote unauthenticated attacker may attempt to log in to an arbitrary host via Windows system where the product is running.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.492% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://jvn.jp/en/jp/JVN82536398/
https://mfp-support.sios.jp/hc/ja/articles/45853460006937
https://siosapps.sios.jp/agent_info/20250425001.html

History

Apr 28, 2025 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 28, 2025 12:15 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, a remote unauthenticated attacker may attempt to log in to an arbitrary host via Windows system where the product is running.
Weaknesses		CWE-923
References		https://jvn.jp/en/jp/JVN82536398/ https://mfp-support.sios.jp/hc/ja/articles/45853460006937 https://siosapps.sios.jp/agent_info/20250425001.html
Metrics		cvssV3_0 `{'score': 5.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N'}`