VulnerabilityAnalyzed

CVE-2025-66360

An improperly configured access control policy exposes sensitive Logpoint internal service (Redis) information to li-admin users.

MEDIUM 6.9EPSS 0.30%

Does this matter?

Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in Logpoint before 7.7.0. An improperly configured access control policy exposes sensitive Logpoint internal service (Redis) information to li-admin users. This can lead to privilege escalation.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.30% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-863
Affected: logpoint/siem
Source: cve@mitre.org

References

https://servicedesk.logpoint.com/hc/en-us/articles/29160917867549-Redis-communication-exposed-for-internal-communicationVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.