CVE-2025-0556: Telerik Report Server Info Disclosure Bug

CVE-2025-0556 Overview

CVE-2025-0556 affects Progress Telerik Report Server versions prior to 2025 Q1 (11.0.25.211) running on the legacy .NET Framework implementation. The service agent process and app host process exchange non-sensitive information over an unencrypted local tunnel. An attacker positioned on the local network can sniff this traffic and observe internal application communications. The issue is classified under CWE-319: Cleartext Transmission of Sensitive Information. Progress addressed the flaw in the 2025 Q1 release.

Critical Impact
Local network attackers can intercept inter-process communications between the Telerik Report Server service agent and app host, exposing information transmitted in cleartext.

Affected Products

Progress Telerik Report Server versions prior to 2025 Q1 (11.0.25.211)
Deployments using the older .NET Framework implementation
Environments where service agent and app host communicate over the local network

Discovery Timeline

2025-02-12 - CVE-2025-0556 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0556

Vulnerability Analysis

Progress Telerik Report Server splits functionality between a service agent process and an app host process. On the .NET Framework build, these components exchange messages through an unencrypted tunnel. Any actor with access to the local network segment carrying this traffic can passively capture the data stream.

The vendor characterizes the exposed content as non-sensitive. However, cleartext transmission still reveals internal application behavior, process interactions, and configuration signals useful for reconnaissance. This information can support follow-on attacks against the reporting infrastructure.

The flaw maps to CWE-319, which covers protocols and channels that fail to protect data confidentiality during transit. Exploitation requires user interaction and network adjacency to the communication path.

Root Cause

The root cause is missing transport encryption between two cooperating processes. The .NET Framework implementation relies on a plaintext channel rather than wrapping the tunnel in Transport Layer Security (TLS) or an equivalent cryptographic layer. No integrity or confidentiality controls protect the messages exchanged.

Attack Vector

An attacker positioned on the same local network as the Report Server deployment captures traffic between the service agent and app host. Techniques include Address Resolution Protocol (ARP) spoofing, switch port mirroring, or passive packet capture on shared infrastructure. The attacker parses the cleartext stream to extract application-level information. Refer to the Telerik Security Advisory for vendor-provided technical detail.

Detection Methods for CVE-2025-0556

Indicators of Compromise

Unexpected packet capture tools or promiscuous mode network interfaces on hosts near the Report Server
ARP table anomalies or duplicate MAC addresses on network segments hosting Telerik Report Server
Unusual east-west traffic patterns targeting the service agent or app host ports

Detection Strategies

Inventory all Telerik Report Server installations and identify instances running versions prior to 11.0.25.211 on the .NET Framework build
Inspect network flows between the service agent and app host processes for plaintext protocol signatures
Correlate authentication events with local network reconnaissance activity around the Report Server hosts

Monitoring Recommendations

Enable network flow logging on VLANs hosting Telerik Report Server components
Alert on new sniffing tools, WinPcap, or Npcap driver installations on servers adjacent to the Report Server
Monitor for ARP spoofing indicators using switch-level or endpoint telemetry

How to Mitigate CVE-2025-0556

Immediate Actions Required

Upgrade Progress Telerik Report Server to version 2025 Q1 (11.0.25.211) or later
Migrate deployments off the legacy .NET Framework implementation where feasible
Segment the Report Server onto a dedicated VLAN to limit local network exposure
Review the Telerik Security Advisory for CVE-2025-0556 for vendor guidance

Patch Information

Progress released Telerik Report Server 2025 Q1 (11.0.25.211) to address CVE-2025-0556. The update removes the cleartext tunnel between the service agent and app host processes. Administrators should apply the update on all affected instances and verify the version after installation.

Workarounds

Restrict local network access to Report Server hosts using host-based firewall rules and network access control lists
Enforce port security and dynamic ARP inspection on switches serving Report Server subnets
Isolate the Report Server components behind a management network with strict ingress controls until the patch is applied

bash

# Verify installed Telerik Report Server version on Windows
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Telerik Report Server*" } |
  Select-Object DisplayName, DisplayVersion

# Confirmed fixed version: 11.0.25.211 (2025 Q1)