{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-55248", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-08-11T20:26:16.634Z", "datePublished": "2025-10-14T17:00:59.059Z", "dateUpdated": "2025-10-17T16:38:54.609Z"}, "containers": {"cna": {"title": ".NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability", "datePublic": "2025-10-14T07:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.0.21"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.12.0", "versionEndExcluding": "17.12.13"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.10.0", "versionEndExcluding": "17.10.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.14.0", "versionEndExcluding": "17.14.17"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.0", "versionEndExcluding": "4.8.04798.02"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.0", "versionEndExcluding": "4.8.04798.02"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7.0", "versionEndExcluding": "4.7.04137.03"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7.0", "versionEndExcluding": "4.7.04137.03"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.1", "versionEndExcluding": "4.8.1.09320.02"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7.0", "versionEndExcluding": "4.7.04137.03"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:sp2:*:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "2.0.50727.8981"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:sp2:*:*:*:*:*:*", "versionStartIncluding": "3.0.0", "versionEndExcluding": "2.0.50727.8981"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5.0", "versionEndExcluding": "2.0.50727.8981"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5.0", "versionEndExcluding": "2.0.50727.8981"}]}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 8.0", "platforms": ["Unknown"], "versions": [{"version": "8.0.0", "lessThan": "8.0.21", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 9.0", "platforms": ["Unknown"], "versions": [{"version": "9.0.0", "lessThan": "9.0.10", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.12", "platforms": ["Unknown"], "versions": [{"version": "17.12.0", "lessThan": "17.12.13", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.10", "platforms": ["Unknown"], "versions": [{"version": "17.10.0", "lessThan": "17.10.20", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.14", "platforms": ["Unknown"], "versions": [{"version": "17.14.0", "lessThan": "17.14.17", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 4.8", "platforms": ["Windows 10 Version 1607 for 32-bit Systems", "Windows 10 Version 1607 for x64-based Systems", "Windows Server 2016", "Windows Server 2016 (Server Core installation)", "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"], "versions": [{"version": "4.8.0", "lessThan": "4.8.04798.02", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.8", "platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows Server 2019", "Windows Server 2019 (Server Core installation)", "Windows Server 2022", "Windows Server 2022 (Server Core installation)", "Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 10 Version 22H2 for x64-based Systems", "Windows 10 Version 22H2 for ARM64-based Systems", "Windows 10 Version 22H2 for 32-bit Systems"], "versions": [{"version": "4.8.0", "lessThan": "4.8.04798.02", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.7.2", "platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows Server 2019", "Windows Server 2019 (Server Core installation)", "Windows 10 Version 1607 for 32-bit Systems", "Windows 10 Version 1607 for x64-based Systems", "Windows Server 2016", "Windows Server 2016 (Server Core installation)"], "versions": [{"version": "4.7.0", "lessThan": "4.7.04137.03", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2", "platforms": ["Windows Server 2008 R2 for x64-based Systems Service Pack 1", "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"], "versions": [{"version": "4.7.0", "lessThan": "4.7.04137.03", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.8.1", "platforms": ["Windows Server 2022", "Windows Server 2022 (Server Core installation)", "Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 11 Version 22H2 for ARM64-based Systems", "Windows 11 Version 22H2 for x64-based Systems", "Windows 10 Version 22H2 for x64-based Systems", "Windows 10 Version 22H2 for ARM64-based Systems", "Windows 10 Version 22H2 for 32-bit Systems", "Windows 11 Version 23H2 for ARM64-based Systems", "Windows 11 Version 23H2 for x64-based Systems", "Windows Server 2022, 23H2 Edition (Server Core installation)", "Windows 11 Version 24H2 for ARM64-based Systems", "Windows 11 Version 24H2 for x64-based Systems", "Windows 11 Version 25H2 for ARM64-based Systems", "Windows 11 Version 25H2 for x64-based Systems"], "versions": [{"version": "4.8.1", "lessThan": "4.8.1.09320.02", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 4.6.2", "platforms": ["Windows Server 2008 for 32-bit Systems Service Pack 2", "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "Windows Server 2008 for x64-based Systems Service Pack 2", "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)"], "versions": [{"version": "4.7.0", "lessThan": "4.7.04137.03", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 2.0 Service Pack 2", "platforms": ["Windows Server 2008 for 32-bit Systems Service Pack 2", "Windows Server 2008 for x64-based Systems Service Pack 2"], "versions": [{"version": "2.0.0", "lessThan": "2.0.50727.8981", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.0 Service Pack 2", "platforms": ["Windows Server 2008 for 32-bit Systems Service Pack 2", "Windows Server 2008 for x64-based Systems Service Pack 2"], "versions": [{"version": "3.0.0", "lessThan": "2.0.50727.8981", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5", "platforms": ["Windows Server 2008 for 32-bit Systems Service Pack 2", "Windows Server 2008 for x64-based Systems Service Pack 2", "Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"], "versions": [{"version": "3.5.0", "lessThan": "2.0.50727.8981", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5.1", "platforms": ["Windows Server 2008 R2 for x64-based Systems Service Pack 1", "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)"], "versions": [{"version": "3.5.0", "lessThan": "2.0.50727.8981", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-326: Inadequate Encryption Strength", "lang": "en-US", "type": "CWE", "cweId": "CWE-326"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-10-17T16:38:54.609Z"}, "references": [{"name": ".NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55248"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T19:18:38.015089Z", "id": "CVE-2025-55248", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T19:24:07.203Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-55248", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T19:18:38.015089Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T19:18:38.837Z"}}], "cna": {"title": ".NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 8.0", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "8.0.21", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": ".NET 9.0", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.0.10", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.12", "versions": [{"status": "affected", "version": "17.12.0", "lessThan": "17.12.13", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.10", "versions": [{"status": "affected", "version": "17.10.0", "lessThan": "17.10.20", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.14", "versions": [{"status": "affected", "version": "17.14.0", "lessThan": "17.14.17", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 4.8", "versions": [{"status": "affected", "version": "4.8.0", "lessThan": "4.8.04798.02", "versionType": "custom"}], "platforms": ["Windows 10 Version 1607 for 32-bit Systems", "Windows 10 Version 1607 for x64-based Systems", "Windows Server 2016", "Windows Server 2016 (Server Core installation)", "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.8", "versions": [{"status": "affected", "version": "4.8.0", "lessThan": "4.8.04798.02", "versionType": "custom"}], "platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows Server 2019", "Windows Server 2019 (Server Core installation)", "Windows Server 2022", "Windows Server 2022 (Server Core installation)", "Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 10 Version 22H2 for x64-based Systems", "Windows 10 Version 22H2 for ARM64-based Systems", "Windows 10 Version 22H2 for 32-bit Systems"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.7.2", "versions": [{"status": "affected", "version": "4.7.0", "lessThan": "4.7.04137.03", "versionType": "custom"}], "platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows Server 2019", "Windows Server 2019 (Server Core installation)", "Windows 10 Version 1607 for 32-bit Systems", "Windows 10 Version 1607 for x64-based Systems", "Windows Server 2016", "Windows Server 2016 (Server Core installation)"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2", "versions": [{"status": "affected", "version": "4.7.0", "lessThan": "4.7.04137.03", "versionType": "custom"}], "platforms": ["Windows Server 2008 R2 for x64-based Systems Service Pack 1", "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.8.1", "versions": [{"status": "affected", "version": "4.8.1", "lessThan": "4.8.1.09320.02", "versionType": "custom"}], "platforms": ["Windows Server 2022", "Windows Server 2022 (Server Core installation)", "Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 11 Version 22H2 for ARM64-based Systems", "Windows 11 Version 22H2 for x64-based Systems", "Windows 10 Version 22H2 for x64-based Systems", "Windows 10 Version 22H2 for ARM64-based Systems", "Windows 10 Version 22H2 for 32-bit Systems", "Windows 11 Version 23H2 for ARM64-based Systems", "Windows 11 Version 23H2 for x64-based Systems", "Windows Server 2022, 23H2 Edition (Server Core installation)", "Windows 11 Version 24H2 for ARM64-based Systems", "Windows 11 Version 24H2 for x64-based Systems", "Windows 11 Version 25H2 for ARM64-based Systems", "Windows 11 Version 25H2 for x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 4.6.2", "versions": [{"status": "affected", "version": "4.7.0", "lessThan": "4.7.04137.03", "versionType": "custom"}], "platforms": ["Windows Server 2008 for 32-bit Systems Service Pack 2", "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "Windows Server 2008 for x64-based Systems Service Pack 2", "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 2.0 Service Pack 2", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.0.50727.8981", "versionType": "custom"}], "platforms": ["Windows Server 2008 for 32-bit Systems Service Pack 2", "Windows Server 2008 for x64-based Systems Service Pack 2"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.0 Service Pack 2", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "2.0.50727.8981", "versionType": "custom"}], "platforms": ["Windows Server 2008 for 32-bit Systems Service Pack 2", "Windows Server 2008 for x64-based Systems Service Pack 2"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5", "versions": [{"status": "affected", "version": "3.5.0", "lessThan": "2.0.50727.8981", "versionType": "custom"}], "platforms": ["Windows Server 2008 for 32-bit Systems Service Pack 2", "Windows Server 2008 for x64-based Systems Service Pack 2", "Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5.1", "versions": [{"status": "affected", "version": "3.5.0", "lessThan": "2.0.50727.8981", "versionType": "custom"}], "platforms": ["Windows Server 2008 R2 for x64-based Systems Service Pack 1", "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)"]}], "datePublic": "2025-10-14T07:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55248", "name": ".NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-326", "description": "CWE-326: Inadequate Encryption Strength"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "8.0.21", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "9.0.10", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "17.12.13", "versionStartIncluding": "17.12.0"}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "17.10.20", "versionStartIncluding": "17.10.0"}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "17.14.17", "versionStartIncluding": "17.14.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.8.04798.02", "versionStartIncluding": "4.8.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.8.04798.02", "versionStartIncluding": "4.8.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.7.04137.03", "versionStartIncluding": "4.7.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.7.04137.03", "versionStartIncluding": "4.7.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.8.1.09320.02", "versionStartIncluding": "4.8.1"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.7.04137.03", "versionStartIncluding": "4.7.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:sp2:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.0.50727.8981", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:sp2:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.0.50727.8981", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.0.50727.8981", "versionStartIncluding": "3.5.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.0.50727.8981", "versionStartIncluding": "3.5.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-10-17T16:38:54.609Z"}}}, "cveMetadata": {"cveId": "CVE-2025-55248", "state": "PUBLISHED", "dateUpdated": "2025-10-17T16:38:54.609Z", "dateReserved": "2025-08-11T20:26:16.634Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2025-10-14T17:00:59.059Z", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network."}], "id": "CVE-2025-55248", "lastModified": "2025-10-14T19:35:56.913", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "secure@microsoft.com", "type": "Primary"}]}, "published": "2025-10-14T17:15:44.787", "references": [{"source": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55248"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-326"}], "source": "secure@microsoft.com", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2025:18152", "cpe": "cpe:/o:redhat:enterprise_linux:10.0", "package": "dotnet8.0-0:8.0.121-1.el10_0", "product_name": "Red Hat Enterprise Linux 10", "release_date": "2025-10-15T00:00:00Z"}, {"advisory": "RHSA-2025:18153", "cpe": "cpe:/o:redhat:enterprise_linux:10.0", "package": "dotnet9.0-0:9.0.111-1.el10_0", "product_name": "Red Hat Enterprise Linux 10", "release_date": "2025-10-15T00:00:00Z"}, {"advisory": "RHSA-2025:18148", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "dotnet8.0-0:8.0.121-1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-10-15T00:00:00Z"}, {"advisory": "RHSA-2025:18150", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "dotnet9.0-0:9.0.111-1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-10-15T00:00:00Z"}, {"advisory": "RHSA-2025:18149", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "dotnet8.0-0:8.0.121-1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-10-15T00:00:00Z"}, {"advisory": "RHSA-2025:18151", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "dotnet9.0-0:9.0.111-1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-10-15T00:00:00Z"}], "bugzilla": {"description": "dotnet: .NET Information Disclosure Vulnerability", "id": "2403083", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403083"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "status": "verified"}, "cwe": "CWE-319", "details": ["Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.", "A flaw exists in certain .NET builds where a man-in-the-middle (MITM) attacker can prevent or downgrade TLS between a client and an SMTP server. This may cause the client to send credentials or message data over an unencrypted connection, exposing sensitive information to the attacker."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-55248", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "rhel8/dotnet-80", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "rhel8/dotnet-90", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "ubi8/dotnet-80", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "ubi8/dotnet-90", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "dotnet6.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "dotnet7.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3:", "fix_state": "Affected", "package_name": "devspaces/udi-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2025-10-15T12:39:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-55248\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-55248"], "statement": "The Red Hat Product Security team has assessed the severity of this vulnerability as High, given that it can be remotely exploited by a man-in-the-middle attacker without authentication or user interaction. Successful exploitation allows an attacker to disable TLS protection between a .NET client and an SMTP server, leading to exposure of credentials and message contents over an unencrypted connection. The vulnerability results from insufficient enforcement of TLS during SMTP session negotiation in the affected .NET runtime.", "threat_severity": "Important"}