{"id":86006,"date":"2025-12-10T13:07:38","date_gmt":"2025-12-10T13:07:38","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-27582-one-identity-password-manager-secure-password-extension-local-privilege-escalation-vulnerability","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-27582-one-identity-password-manager-secure-password-extension-local-privilege-escalation-vulnerability\/","title":{"rendered":"CVE-2025-27582: One Identity Password Manager Secure Password Extension Local Privilege Escalation Vulnerability<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

This report provides an in-depth analysis of a significant local privilege escalation vulnerability in One Identity Password Manager’s Secure Password extension. This vulnerability, identified as CVE-2025-27582, has the potential to put a wide range of systems at risk, allowing an attacker with access to a locked workstation to gain SYSTEM-level privileges and obtain full control over the affected device. Given the high severity of this vulnerability, understanding its implications, and implementing appropriate mitigation measures is of paramount importance.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-27582
\nSeverity: High (CVSS: 7.6)
\nAttack Vector: Local
\nPrivileges Required: Low
\nUser Interaction: Required
\nImpact: Potential system compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

One Identity Password Manager | Before 5.14.4<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The issue arises from a flawed security hardening mechanism within the kiosk browser used to display the Password Self-Service site to end users. The application attempts to restrict privileged actions by overriding the native window.print() function. However, this protection can be bypassed by an attacker who accesses the Password Self-Service site from the lock screen and navigates to an attacker-controlled webpage via the Help function. By hosting a crafted web page with JavaScript, the attacker can restore and invoke the window.print() function, launching a SYSTEM-privileged print dialog. From this dialog, the attacker can exploit standard Windows functionality – such as the Print to PDF or Add Printer wizard – to spawn a command prompt with SYSTEM privileges.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

The following JavaScript code is a conceptual example of how this vulnerability might be exploited:<\/p>\n

\/\/ Bypass the overridden window.print function\nvar originalPrint = window.print;\nwindow.print = function() {\n\/\/ Restore the original print function\nwindow.print = originalPrint;\n\/\/ Invoke the SYSTEM-privileged print dialog\nwindow.print();\n};<\/code><\/pre>\n
This code would be hosted on an attacker-controlled webpage, which the attacker would trick the user into navigating to via the Password Self-Service site’s Help function.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview This report provides an in-depth analysis of a significant local privilege escalation vulnerability in One Identity Password Manager’s Secure Password extension. This vulnerability, identified as CVE-2025-27582, has the potential to put a wide range of systems at risk, allowing an attacker with access to a locked workstation to gain SYSTEM-level privileges and obtain full […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86006","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t