VulnerabilityAnalyzed

CVE-2025-43720

Headwind MDM before 5.33.1 makes configuration details accessible to unauthorized users.

MEDIUM 6.5EPSS 0.36%

Does this matter?

Lower severity and a low EPSS score (0.36%). Track it; it rarely justifies an emergency change on its own.

Description

Headwind MDM before 5.33.1 makes configuration details accessible to unauthorized users. The Configuration profile is exposed to the Observer user role, revealing the password requires to escape out of the MDM controlled device's profile.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.36% probability · 30th percentile
CISA KEV: Not listed
Weakness: CWE-862
Affected: h-mdm/headwind mdm
Source: cve@mitre.org

References

https://github.com/h-mdm/hmdm-server/commit/19e4a63f732c99064444df7e8c61b4f01df362e8Patch
https://github.com/h-mdm/hmdm-server/compare/v5.32.1...v5.33.1Patch
https://www.periculo.co.uk/cyber-security-blog/how-our-pen-tester-found-a-critical-vulnerability-cve-2025-43720Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.