CVE-2025-35114
📋 TL;DR
Agiloft Release 28 contains default credential accounts that could allow attackers to escalate privileges locally. The password hash is known and crackable offline, potentially granting unauthorized access. This affects all users running Agiloft Release 28.
💻 Affected Systems
- Agiloft
📦 What is this software?
Agiloft by Atlassian
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through local privilege escalation leading to data theft, system manipulation, or installation of persistent backdoors.
Likely Case
Unauthorized access to sensitive Agiloft data and configuration settings by local attackers who crack the known password hash.
If Mitigated
Limited impact if strong network segmentation and access controls prevent local attackers from reaching the system.
🎯 Exploit Status
Exploitation requires local access and password cracking of known hash, which is technically simple with available tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Release 30
Vendor Advisory: https://wiki.agiloft.com/display/HELP/What%27s+New%3A+CVE+Resolution
Restart Required: Yes
Instructions:
1. Backup Agiloft data and configuration. 2. Download Agiloft Release 30 from vendor portal. 3. Run upgrade installer following vendor documentation. 4. Restart Agiloft services. 5. Verify upgrade completion.
🔧 Temporary Workarounds
Change Default Credentials
allManually change passwords for all default accounts in Agiloft Release 28.
Use Agiloft admin interface to change passwords for all user accounts
Restrict Local Access
allImplement network segmentation and access controls to limit who can reach the Agiloft system locally.
Configure firewall rules to restrict access to Agiloft ports from trusted IPs only
🧯 If You Can't Patch
- Immediately change all default account passwords using strong, unique credentials
- Implement strict network segmentation and monitor for unauthorized local access attempts
🔍 How to Verify
Check if Vulnerable:
Check Agiloft version in admin interface or configuration files; if Release 28, assume vulnerable unless default credentials were changed.Check Version:
Check Agiloft admin dashboard or consult vendor documentation for version commandVerify Fix Applied:
Confirm Agiloft version shows Release 30 in admin interface and test that default credentials no longer work.📡 Detection & Monitoring
Log Indicators:
- Failed login attempts followed by successful logins from default accounts
- Unusual privilege escalation activities in system logs
Network Indicators:
- Unexpected local network traffic to Agiloft ports from unauthorized sources
SIEM Query:
source="agiloft_logs" AND (event_type="authentication" AND (user="default_account" OR status="success" after multiple failures))