CVE-2025-58079: desknet's NEO AppSuite Privilege Escalation

CVE-2025-58079 Overview

CVE-2025-58079 is an Improper Protection of Alternate Path vulnerability [CWE-424] affecting the AppSuite component of desknet's NEO, a Japanese groupware platform. The flaw impacts versions V4.0R1.0 through V9.0R2.0. An authenticated attacker with low privileges can create malicious AppSuite applications on the affected system, undermining the integrity controls that restrict application creation. The vulnerability was published to the National Vulnerability Database (NVD) on October 16, 2025, and cataloged through the Japan Vulnerability Notes (JVN) advisory JVN90757550.

Critical Impact
Authenticated attackers can bypass path protection controls to introduce malicious AppSuite applications into desknet's NEO deployments, affecting integrity of the groupware environment.

Affected Products

desknet's NEO AppSuite V4.0R1.0 through V9.0R2.0
Groupware deployments hosting the AppSuite module
On-premises desknet's NEO installations within the affected version range

Discovery Timeline

2025-10-16 - CVE-2025-58079 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58079

Vulnerability Analysis

The vulnerability originates in the AppSuite module of desknet's NEO, a business groupware platform used widely in Japan. AppSuite allows users to build custom business applications inside the groupware environment. The affected code fails to properly restrict alternate paths used during application creation. As a result, an authenticated user with low privileges can invoke functionality intended for higher-privileged roles and register malicious AppSuite applications. The impact is scoped to integrity, since exploitation requires valid credentials and does not directly expose data or disrupt availability.

Root Cause

The root cause is classified under [CWE-424: Improper Protection of Alternate Path]. The AppSuite component exposes multiple code paths that reach the same application creation logic, but not all of these paths enforce equivalent authorization checks. An attacker who identifies the unprotected path can invoke privileged operations without meeting the intended access requirements.

Attack Vector

Exploitation requires network access to the desknet's NEO web interface and valid low-privilege credentials. No user interaction is required. An attacker submits crafted requests to the alternate path exposed by AppSuite and registers unauthorized applications. These applications can then be used to influence groupware workflows or serve as a foothold for further activity within the tenant. Because desknet's NEO has not published exploit code and CVE-2025-58079 is not listed in the CISA Known Exploited Vulnerabilities catalog, opportunistic exploitation has not been reported.

Refer to the JVN Security Advisory and the Desknets Maintenance Information for vendor-provided technical detail.

Detection Methods for CVE-2025-58079

Indicators of Compromise

Unexpected AppSuite applications appearing in the administration console that were not created by authorized administrators.
HTTP requests from low-privilege accounts to AppSuite endpoints associated with application creation or import.
Audit log entries showing application registration events tied to non-administrative user accounts.

Detection Strategies

Review AppSuite application inventories against an approved baseline and flag new entries created outside the change management process.
Correlate web server access logs with application creation events to identify requests reaching administrative functionality from non-administrative sessions.
Alert on authentication sessions that invoke AppSuite management endpoints without matching role assignments in the identity store.

Monitoring Recommendations

Enable and centralize desknet's NEO application-layer audit logs, including AppSuite management actions.
Forward web server and application logs to a SIEM for correlation with authentication events.
Monitor for repeated 4xx or unusual 2xx responses on AppSuite management URLs originating from standard user sessions.

How to Mitigate CVE-2025-58079

Immediate Actions Required

Identify all desknet's NEO deployments running versions V4.0R1.0 through V9.0R2.0 and prioritize them for patching.
Apply the fixed release published by the vendor in the Desknets Maintenance Information advisory.
Audit existing AppSuite applications and remove any that cannot be attributed to an authorized administrator.
Rotate credentials for any low-privilege accounts suspected of misuse.

Patch Information

The vendor has published fix information through the Desknets maintenance portal referenced in JVN90757550. Administrators should consult the Desknets Maintenance Information page for the specific fixed build applicable to their installed version and apply it through the standard update process. Verify successful patch installation by checking the AppSuite module version in the administration console after the upgrade.

Workarounds

Restrict network access to the desknet's NEO web interface using firewall rules or reverse proxy allow-lists until patches are applied.
Limit AppSuite usage to trusted administrative accounts and disable self-service application creation where feasible.
Enforce multi-factor authentication on all groupware accounts to raise the cost of credential-based exploitation.

bash

# Example: restrict access to the desknet's NEO web interface at the reverse proxy
# Replace <trusted_subnet> and <backend> with environment-specific values
location /appsuite/ {
    allow <trusted_subnet>;
    deny all;
    proxy_pass http://<backend>;
}