SB2025091812 - Multiple vulnerabilities in Wondershare Repairit

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Incorrect Privilege Assignment (CVE-ID: CVE-2025-10643)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to incorrect privilege assignment within within the permissions granted to a storage account token. A remote attacker can bypass authentication on the system.

2) Incorrect Privilege Assignment (CVE-ID: CVE-2025-10644)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to incorrect privilege assignment within within the permissions granted to an SAS token. A remote attacker can bypass authentication and execute arbitrary code on the system.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.zerodayinitiative.com/advisories/ZDI-25-895/
• https://www.zerodayinitiative.com/advisories/ZDI-25-896/