CVE-2025-12100: MongoDB BI Connector ODBC Vulnerability

CVE-2025-12100 Overview

CVE-2025-12100 is an Incorrect Default Permissions vulnerability [CWE-276] in the MongoDB BI Connector Open Database Connectivity (ODBC) driver. The flaw affects versions 1.0.0 through 1.4.6 and enables local privilege escalation. A low-privileged local user can leverage insecure default permissions on driver files or directories to gain higher-level access on the host. MongoDB addressed the issue in release v1.4.7.

Critical Impact
Local attackers with low privileges can escalate to higher privileges, gaining full confidentiality, integrity, and availability impact on the affected system and downstream components.

Affected Products

MongoDB BI Connector ODBC driver 1.0.0 through 1.4.6
Windows and other platforms where the ODBC driver is installed with default permissions
Downstream applications relying on the affected ODBC driver for MongoDB Business Intelligence connectivity

Discovery Timeline

2025-10-23 - CVE-2025-12100 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12100

Vulnerability Analysis

The vulnerability stems from incorrect default permissions applied to files or directories installed by the MongoDB BI Connector ODBC driver. When the installer places driver components on disk, permission access control lists allow write or modify access to users who should not have that authority. A local attacker can replace, modify, or plant executables and libraries loaded by a higher-privileged process. When a privileged user or service subsequently invokes the driver, the attacker-controlled payload executes with elevated privileges.

The attack requires local access and low privileges, but no user interaction beyond normal driver usage by the privileged victim. The scope crosses trust boundaries, resulting in high confidentiality, integrity, and availability impact on both the vulnerable component and adjacent systems that rely on it.

Root Cause

The root cause is a misconfiguration of file system permissions applied during installation of the ODBC driver. [CWE-276] describes scenarios where a resource is created with default permissions that grant excessive access to unintended actors. In this case, the driver's installation routine did not enforce restrictive access control on binaries, configuration files, or supporting libraries.

Attack Vector

Exploitation requires a local, authenticated user on the target system. The attacker identifies writable driver components in the ODBC installation path and modifies or replaces them with malicious content. When a service, scheduled task, or higher-privileged user loads the driver, the substituted code executes in that security context. See the MongoDB BI Connector ODBC Driver v1.4.7 release notes for the corrective changes.

No public proof-of-concept exploit is currently listed for CVE-2025-12100, and the EPSS score indicates a low likelihood of exploitation in the near term.

Detection Methods for CVE-2025-12100

Indicators of Compromise

Unexpected modifications to files or DLLs within the MongoDB BI Connector ODBC driver installation directory
New or altered binaries in the driver path with timestamps that do not match the installer
Non-administrative user accounts holding write permissions on driver files or parent directories
Privileged process launches originating from ODBC driver components not signed by MongoDB

Detection Strategies

Audit file system access control lists on the ODBC driver installation directory and compare against a known-good baseline from version 1.4.7
Monitor process creation events where MongoDB BI Connector ODBC binaries load into services or elevated user sessions
Alert on write operations to driver directories performed by non-administrative accounts
Correlate driver file modification events with subsequent privileged process activity

Monitoring Recommendations

Enable file integrity monitoring on all MongoDB BI Connector ODBC driver installation paths
Log ODBC driver load events and review for unexpected loading contexts
Track user accounts and groups holding modify permissions on ODBC directories across the environment

How to Mitigate CVE-2025-12100

Immediate Actions Required

Inventory all systems running MongoDB BI Connector ODBC driver versions 1.0.0 through 1.4.6
Upgrade affected installations to version 1.4.7 or later as published in the official GitHub release
Review and correct file system permissions on existing driver directories to remove write access from non-administrative users
Rotate credentials that may have transited through a compromised driver instance

Patch Information

MongoDB released version 1.4.7 of the BI Connector ODBC driver, which corrects the default permissions applied during installation. Administrators should download the fixed release from the MongoDB BI Connector ODBC Driver v1.4.7 release page and reinstall on all affected hosts. Verify that upgraded installations apply the corrected permission model rather than inheriting the prior insecure state.

Workarounds

Manually restrict permissions on the ODBC driver installation directory to Administrators and SYSTEM only, removing write access from standard users and groups
Restrict interactive local logon on hosts where the driver runs under privileged service accounts until patching is complete
Isolate systems running the vulnerable driver from untrusted local users pending upgrade to 1.4.7

bash

# Example: restrict permissions on the ODBC driver directory (Windows)
icacls "C:\Program Files\MongoDB\BI Connector ODBC Driver" /inheritance:r
icacls "C:\Program Files\MongoDB\BI Connector ODBC Driver" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"