NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-26766.
References
| Link | Resource |
|---|---|
| https://kb.nomachine.com/TR04W11314 | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-25-835/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
10 Sep 2025, 14:36
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Nomachine
Nomachine nomachine |
|
| CPE | cpe:2.3:a:nomachine:nomachine:*:*:*:*:*:*:*:* | |
| References | () https://kb.nomachine.com/TR04W11314 - Vendor Advisory | |
| References | () https://www.zerodayinitiative.com/advisories/ZDI-25-835/ - Third Party Advisory |
02 Sep 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-02 20:15
Updated : 2025-09-10 14:36
NVD link : CVE-2025-8614
Mitre link : CVE-2025-8614
CVE.ORG link : CVE-2025-8614
JSON object : View
Products Affected
nomachine
- nomachine
CWE
CWE-427
Uncontrolled Search Path Element