CVE-2025-10644CRITICAL 9.4EPSS p88.4%

CVE-2025-10644CVE-2025-10644

Description

Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on Wondershare Repairit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the permissions granted to an SAS token. An attacker can leverage this vulnerability to launch a supply-chain attack and execute arbitrary code on customers' endpoints. Was ZDI-CAN-26892.

Scoring

CVSS 3.09.4 (CRITICAL)
VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS3.74% probability of exploitation · percentile 88.4% · 2026-06-18T12:00:27Z
Published2025-09-17
Last modified2025-09-19

Underlying weaknesses· 1

CWE-266

References

  1. https://www.zerodayinitiative.com/advisories/ZDI-25-896/

1

TypeTargetConfidenceTier
WeaknessIncorrect Privilege Assignmentcwe-2660%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-10643
CVE
CVE-2025-41672
CVE
CVE-2025-64075
CVE
CVE-2025-54452
CVE
CVE-2025-10611
CVE
CVE-2025-14101
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.