CVE-2025-10644CRITICAL 9.4EPSS p86.9%

CVE-2025-10644CVE-2025-10644

wondershare / repairit

Description

Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on Wondershare Repairit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the permissions granted to an SAS token. An attacker can leverage this vulnerability to launch a supply-chain attack and execute arbitrary code on customers' endpoints. Was ZDI-CAN-26892.

Scoring

CVSS 3.09.4 (CRITICAL)
VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS3.00% probability of exploitation · percentile 86.9% · 2026-10-05T12:00:23Z
Published2025-09-17
Last modified2026-09-26

Underlying weaknesses· 1

CWE-266

References

  1. https://www.zerodayinitiative.com/advisories/ZDI-25-896/

1

TypeTargetConfidenceTier
WeaknessIncorrect Privilege Assignmentcwe-2660%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-10643
CVE
CVE-2025-41672
CVE
CVE-2025-64075
CVE
CVE-2025-54452
CVE
CVE-2025-10611
CVE
CVE-2025-14101
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.