CVE-2025-58426: desknet's NEO Hard-Coded Key Vulnerability

CVE-2025-58426 Overview

CVE-2025-58426 is a hard-coded cryptographic key vulnerability in desknet's NEO, a Japanese enterprise groupware product developed by NEOJAPAN. Affected versions span V4.0R1.0 through V9.0R2.0. An authenticated attacker with low privileges can abuse the embedded key to forge or craft malicious AppSuite applications that the platform accepts as legitimate. The weakness is classified as [CWE-321: Use of Hard-coded Cryptographic Key]. The flaw is network-exploitable and does not require user interaction, but impact is limited to integrity of AppSuite content within the groupware environment.

Critical Impact
Attackers who can authenticate to desknet's NEO can create malicious AppSuite applications accepted as trusted by the platform, enabling tampering within the collaboration environment.

Affected Products

desknet's NEO V4.0R1.0 through V9.0R2.0
AppSuite application component bundled with affected desknet's NEO releases
Deployments relying on the embedded cryptographic key for AppSuite validation

Discovery Timeline

2025-10-16 - CVE-2025-58426 published to the National Vulnerability Database (NVD)
2026-10-09 - Last updated in the NVD database

Technical Details for CVE-2025-58426

Vulnerability Analysis

The vulnerability stems from a cryptographic key compiled directly into desknet's NEO. The product uses this key to sign, encrypt, or validate AppSuite application packages. Because the key is identical across every installation in the affected range, any party that extracts it from one deployment can reuse it against any other. Attackers with valid low-privilege credentials can therefore craft AppSuite applications that pass authenticity checks. The downstream result is tampering with AppSuite content and potential misuse of the trust relationship between the server and its application packages.

Root Cause

The root cause is a design-level failure: a static cryptographic secret embedded in the application binary or configuration. Hard-coded keys cannot be rotated by administrators, cannot be revoked without a vendor patch, and provide no per-tenant or per-installation entropy. Vendor documentation and the JVN #90757550 Advisory describe the issue consistent with [CWE-321].

Attack Vector

Exploitation requires network access to the desknet's NEO instance and valid user credentials. The attacker extracts or obtains the hard-coded key, generates a malicious AppSuite application signed or packaged with that key, and submits it through the normal AppSuite workflow. The server treats the package as trusted and processes it. No verified public proof-of-concept is listed in the NVD record, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog.

See the Desknets Maintenance Information notice for vendor remediation details.

Detection Methods for CVE-2025-58426

Indicators of Compromise

Creation or installation of AppSuite applications from accounts or sources that do not normally publish applications
AppSuite packages whose metadata, authorship, or signature does not match internal change-management records
Unexpected modifications to AppSuite application definitions, forms, or server-side scripts

Detection Strategies

Audit AppSuite application inventories against an approved baseline and flag any package added after the vulnerable window
Review desknet's NEO application logs for AppSuite upload, import, and modification events correlated with low-privilege user sessions
Compare running desknet's NEO version against the fixed release listed in the vendor maintenance notice

Monitoring Recommendations

Forward desknet's NEO web and application logs to a central analytics platform for retention and search
Alert on AppSuite management API calls originating from non-administrator accounts
Monitor outbound connections from the groupware server for anomalies that could indicate a malicious AppSuite callback

How to Mitigate CVE-2025-58426

Immediate Actions Required

Identify every desknet's NEO instance in the V4.0R1.0 to V9.0R2.0 range and schedule the vendor-supplied update
Enforce least-privilege account policies so only vetted administrators can publish AppSuite applications
Review existing AppSuite applications and remove packages that cannot be attributed to an authorized publisher

Patch Information

NEOJAPAN has published remediation guidance in the Desknets Maintenance Information notice. Administrators should apply the fixed desknet's NEO release referenced in that advisory and in the JVN #90757550 Advisory. The vulnerability cannot be remediated by configuration alone because the key is embedded in the product.

Workarounds

Restrict network access to desknet's NEO to trusted internal networks or VPN clients until the patch is deployed
Disable or tightly control the AppSuite application creation and import workflow for non-administrative users
Require manual administrator review and approval before any new AppSuite application is activated

bash

# Example: restrict access to the desknet's NEO web interface at the firewall
# Replace with your internal subnet and the server IP
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -d 192.0.2.25 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -d 192.0.2.25 -j DROP