CVE-2025-52095
📋 TL;DR
This vulnerability in PDQ Smart Deploy allows attackers to decrypt stored credentials using static encryption keys, enabling privilege escalation. Organizations using PDQ Smart Deploy version 3.0.2040 for Windows deployment are affected. Attackers can gain administrative access to managed systems.
💻 Affected Systems
- PDQ Smart Deploy
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete domain compromise through lateral movement using stolen administrative credentials across all managed endpoints.
Likely Case
Local privilege escalation on individual systems leading to credential theft, persistence establishment, and limited lateral movement.
If Mitigated
Isolated impact on single system if proper network segmentation and least privilege are implemented.
🎯 Exploit Status
Exploitation requires access to the Smart Deploy system or its credential storage, but the decryption routine is publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check PDQ website for latest version (likely 3.0.2041 or higher)
Vendor Advisory: https://www.pdq.com/
Restart Required: Yes
Instructions:
1. Check current Smart Deploy version
2. Download latest version from PDQ website
3. Run installer as administrator
4. Restart Smart Deploy services
5. Verify update completed successfully
🔧 Temporary Workarounds
Disable Smart Deploy service
windowsTemporarily stop Smart Deploy services to prevent exploitation
sc stop "PDQSmartDeploy"
sc config "PDQSmartDeploy" start= disabled
Restrict access to Smart Deploy system
allApply strict network ACLs to limit access to Smart Deploy management interface
🧯 If You Can't Patch
- Isolate Smart Deploy system on separate VLAN with strict access controls
- Rotate all credentials stored in Smart Deploy and implement credential vaulting
🔍 How to Verify
Check if Vulnerable:
Check Smart Deploy version in application or via registry: HKEY_LOCAL_MACHINE\SOFTWARE\PDQ\Smart Deploy\VersionCheck Version:
reg query "HKLM\SOFTWARE\PDQ\Smart Deploy" /v VersionVerify Fix Applied:
Verify version is updated to patched release and test credential encryption functionality📡 Detection & Monitoring
Log Indicators:
- Unusual access to SDCommon.dll
- Multiple failed credential decryption attempts
- Unexpected service restarts of PDQSmartDeploy
Network Indicators:
- Unusual connections to Smart Deploy management port (default 7337)
- Credential dumping tools communicating with Smart Deploy system
SIEM Query:
EventID=4688 AND (ProcessName="*SDCommon*" OR CommandLine="*decrypt*" OR ParentProcessName="*SmartDeploy*")