CVE-2025-3621: ActADUR Local Server RCE Vulnerability

CVE-2025-3621 Overview

CVE-2025-3621 is a critical vulnerability affecting the ActADUR local server product developed and maintained by ProTNS. This vulnerability enables Remote Code Inclusion on host systems through a combination of security flaws including Command Injection (CWE-77), Use of Hard-coded Credentials, Improper Authentication, and Binding to an Unrestricted IP Address.

The vulnerability chain allows attackers on an adjacent network to compromise affected systems without requiring authentication or user interaction, potentially leading to complete system takeover.

Critical Impact

Attackers can achieve remote code execution on vulnerable ActADUR servers through command injection, leveraging hard-coded credentials and improper authentication to gain unauthorized access to host systems.

Affected Products

• ActADUR versions from v2.0.1.9 before v2.0.2.0
• ProTNS ActADUR local server deployments
• Systems running vulnerable ActADUR configurations with network exposure

Discovery Timeline

• 2025-07-15 - CVE-2025-3621 published to NVD
• 2025-07-15 - Last updated in NVD database

Technical Details for CVE-2025-3621

Vulnerability Analysis

This vulnerability represents a compound security weakness in the ProTNS ActADUR local server product. The flaw enables remote code inclusion through multiple attack surfaces that, when combined, create a severe risk to affected systems.

The Command Injection component (CWE-77) allows improper neutralization of special elements used in commands, meaning user-controlled input is passed to system command execution without adequate sanitization. Combined with hard-coded credentials embedded in the application, attackers can bypass authentication mechanisms entirely.

The improper authentication flaw compounds the issue by failing to properly verify user identity before granting access to sensitive functionality. Additionally, the binding to an unrestricted IP address means the vulnerable service may be accessible from any network interface, expanding the attack surface beyond intended boundaries.

Successful exploitation allows attackers to execute arbitrary commands on the underlying host system with the privileges of the ActADUR service, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network.

Root Cause

The root cause stems from multiple insecure development practices in the ActADUR local server:

1. Insufficient input sanitization - User-supplied input is directly incorporated into system commands without proper validation or escaping of special characters
2. Hard-coded credentials - Authentication secrets are embedded directly in the application code, making them discoverable through reverse engineering or code analysis
3. Weak authentication design - The authentication mechanism fails to properly verify user identity before granting access to privileged operations
4. Overly permissive network binding - The service binds to all network interfaces (0.0.0.0) rather than restricting to localhost or specific trusted networks

Attack Vector

The attack requires adjacent network access, meaning the attacker must be on the same network segment or have the ability to reach the vulnerable ActADUR service. The attack flow follows this pattern:

1. The attacker identifies an ActADUR server accessible from the adjacent network
2. Using the hard-coded credentials embedded in the application, the attacker bypasses authentication
3. The attacker crafts malicious input containing command injection payloads
4. The vulnerable application executes the injected commands with the service's privileges
5. The attacker achieves arbitrary code execution on the host system

The vulnerability can be exploited by injecting shell metacharacters or command separators into input fields that are subsequently passed to system command execution functions. Common injection techniques include using characters like semicolons, pipes, backticks, or command substitution syntax to chain arbitrary commands.

Detection Methods for CVE-2025-3621

Indicators of Compromise

• Unusual command execution patterns originating from ActADUR server processes
• Authentication attempts using known hard-coded credential patterns
• Network connections from ActADUR services to unexpected external hosts
• System logs showing command injection patterns such as shell metacharacters in input fields
• Unexpected child processes spawned by the ActADUR service

Detection Strategies

• Monitor process execution chains for ActADUR services spawning unexpected child processes such as shells or system utilities
• Implement network traffic analysis to detect unusual connection patterns from ActADUR server ports
• Deploy file integrity monitoring on ActADUR installation directories to detect unauthorized modifications
• Configure authentication logging to capture failed and successful login attempts against ActADUR services

Monitoring Recommendations

• Enable verbose logging on ActADUR servers and forward logs to centralized SIEM solutions
• Implement network segmentation monitoring to detect lateral movement attempts from compromised ActADUR hosts
• Set up alerts for process execution anomalies involving the ActADUR service account
• Monitor for reconnaissance activity targeting ActADUR service ports on the adjacent network

How to Mitigate CVE-2025-3621

Immediate Actions Required

• Update ActADUR to version v2.0.2.0 or above immediately
• Implement network segmentation to restrict access to ActADUR servers from untrusted network segments
• Review firewall rules to ensure ActADUR services are only accessible from authorized systems
• Audit system logs for any indicators of prior exploitation attempts

Patch Information

ProTNS has released version v2.0.2.0 to address this vulnerability. Organizations running ActADUR versions from v2.0.1.9 before v2.0.2.0 should apply this update immediately. For detailed patch information and download instructions, refer to the ProTNS Security Resource.

The update addresses all four vulnerability components: command injection, hard-coded credentials, improper authentication, and unrestricted IP binding.

Workarounds

• Implement strict network access controls to limit connectivity to ActADUR servers to trusted hosts only
• Deploy a web application firewall or network-based intrusion prevention system to filter malicious command injection patterns
• If possible, bind the ActADUR service to localhost or specific trusted interfaces rather than all network interfaces
• Implement additional authentication layers such as VPN or network-level authentication before accessing ActADUR services
• Monitor all ActADUR server activity closely until patches can be applied

Organizations should apply the official patch as soon as possible, as workarounds provide only partial protection against exploitation attempts.