Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://www.outputmessenger.com/cve-2025-27920/ | Vendor Advisory |
| https://www.srimax.com/products-2/output-messenger/ | Product |
| https://www.microsoft.com/en-us/security/blog/2025/05/12/marbled-dust-leverages-zero-day-in-output-messenger-for-regional-espionage/ | Mitigation Third Party Advisory |
Configurations
History
21 May 2025, 19:40
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:srimax:output_messenger:*:*:*:*:*:*:*:* | |
| First Time |
Srimax
Srimax output Messenger |
|
| References | () https://www.microsoft.com/en-us/security/blog/2025/05/12/marbled-dust-leverages-zero-day-in-output-messenger-for-regional-espionage/ - Mitigation, Third Party Advisory | |
| References | () https://www.outputmessenger.com/cve-2025-27920/ - Vendor Advisory | |
| References | () https://www.srimax.com/products-2/output-messenger/ - Product |
19 May 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
05 May 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-05 16:15
Updated : 2025-05-21 19:40
NVD link : CVE-2025-27920
Mitre link : CVE-2025-27920
JSON object : View
Products Affected
srimax
- output_messenger
CWE
No CWE.