CVE-2025-57521

{
  "id": "CVE-2025-57521",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-21T15:15:38.960",
  "lastModified": "2026-11-05T22:10:00.203",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application startup. The application loads a network plugin without validating its digital signature or verifying its authenticity. A local attacker can exploit this behavior by placing a malicious component in the expected location, which is controllable by the attacker (e.g., under %APPDATA%), resulting in code execution within the context of the user. The main application is digitally signed, which may allow a malicious component to inherit trust and evade detection by security solutions that rely on signed parent processes."
    },
    {
      "lang": "es",
      "value": "Bambu Studio 2.1.1.52 y versiones anteriores está afectado por una vulnerabilidad que permite la ejecución de código arbitrario durante el inicio de la aplicación. La aplicación carga un plugin de red sin validar su firma digital ni verificar su autenticidad. Un atacante local puede explotar este comportamiento colocando un componente malicioso en la ubicación esperada, que es controlable por el atacante (por ejemplo, bajo %APPDATA%), lo que resulta en la ejecución de código dentro del contexto del usuario. La aplicación principal está firmada digitalmente, lo que puede permitir que un componente malicioso herede la confianza y evada la detección por parte de las soluciones de seguridad que dependen de procesos padre firmados."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-21T20:23:30.841302Z",
          "id": "CVE-2025-57521",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/bambulab/BambuStudio/issues/7405",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/piuppi/Proof-of-Concepts/blob/main/Bambu%20Lab/Bambu%20Studio/README.md",
      "source": "[email protected]"
    },
    {
      "url": "https://wiki.bambulab.com/en/software/bambu-studio/release/release-note-2-3-0",
      "source": "[email protected]"
    }
  ]
}