CVE-2025-58742: Milner Imagedirector Capture Auth Bypass

CVE-2025-58742 Overview

CVE-2025-58742 is an Adversary-in-the-Middle (AiTM) vulnerability in Milner ImageDirector Capture on Windows. The flaw resides in the Connection Settings dialog, where a local attacker can modify the Server field to redirect client authentication to an attacker-controlled host. The product insufficiently protects credentials and fails to restrict the communication channel to intended endpoints, mapped to [CWE-522].

Affected versions include ImageDirector Capture from 7.0.9 before 7.6.3.25808. Exploitation requires local access with low privileges and no user interaction, enabling capture of authentication material destined for the legitimate server.

Critical Impact

Attackers with local access can intercept client authentication credentials by redirecting traffic to a rogue server, leading to credential theft and downstream account compromise.

Affected Products

• Milner ImageDirector Capture versions 7.0.9 through versions earlier than 7.6.3.25808
• Microsoft Windows (host operating system)
• Deployments using the Connection Settings dialog for server configuration

Discovery Timeline

• 2026-01-20 - CVE-2025-58742 published to the National Vulnerability Database
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2025-58742

Vulnerability Analysis

The vulnerability exists in the Connection Settings dialog of Milner ImageDirector Capture. The Server field accepts arbitrary hostname or IP input without sufficient validation or pinning to an authorized endpoint. When a user authenticates, the client transmits credentials to whatever endpoint is configured in this field.

An attacker with local low-privilege access can modify the Server value to point at a host they control. The client then sends authentication data to the rogue server, where it can be captured. The communication channel is not bound to the intended endpoint, satisfying the conditions for an Adversary-in-the-Middle attack ([CWE-522]).

Because the affected client also exhibits insufficient credential protection, captured material may be reusable against the legitimate ImageDirector backend or other systems that share the same identity.

Root Cause

The root cause is twofold. First, the Connection Settings dialog permits unrestricted modification of the destination server without enforcing endpoint integrity checks such as certificate pinning or signed configuration. Second, credentials are transmitted without adequate protection that would bind them to the intended server identity.

Attack Vector

The attack vector is local. An adversary needs the ability to interact with the client configuration, either through an interactive session or by writing to configuration storage. After altering the Server field, the attacker waits for, or triggers, a legitimate authentication flow and harvests the redirected credentials at the rogue endpoint.

No verified public exploitation code is available. See the SRA Security Advisory for additional technical details.

Detection Methods for CVE-2025-58742

Indicators of Compromise

• Unexpected modifications to ImageDirector Capture Connection Settings, specifically changes to the Server field pointing to non-corporate hostnames or IP addresses.
• Outbound network connections from the ImageDirector Capture client process to hosts outside the approved server inventory.
• Authentication failures at the legitimate ImageDirector server followed by successful logons from anomalous source addresses.

Detection Strategies

• Monitor configuration files and registry locations used by ImageDirector Capture for changes to server endpoint values.
• Baseline expected destination servers for the client and alert on deviations observed at the network layer or DNS resolution layer.
• Correlate process execution of the ImageDirector Capture binary with network destinations to flag unauthorized server endpoints.

Monitoring Recommendations

• Enable endpoint logging that captures application configuration changes and file modifications under the ImageDirector install path.
• Forward network telemetry, DNS queries, and authentication events into a centralized data lake for correlation across hosts.
• Alert on local users with low privileges modifying client server configuration outside of authorized change windows.

How to Mitigate CVE-2025-58742

Immediate Actions Required

• Upgrade Milner ImageDirector Capture to version 7.6.3.25808 or later on all Windows endpoints.
• Inventory all hosts running affected versions between 7.0.9 and 7.6.3.25808 and prioritize patching for users with stored credentials.
• Audit current Connection Settings on deployed clients to verify the Server field points only to authorized endpoints.
• Rotate credentials for any account that may have authenticated through a modified client configuration.

Patch Information

Milner addresses the issue in ImageDirector Capture version 7.6.3.25808. Versions from 7.0.9 up to but not including 7.6.3.25808 remain vulnerable. Refer to the SRA Security Advisory for vendor remediation guidance.

Workarounds

• Restrict local interactive access on hosts running ImageDirector Capture to limit who can alter the Connection Settings dialog.
• Apply file system and registry permissions that prevent low-privilege users from modifying ImageDirector configuration storage.
• Use host-based firewall rules to restrict outbound connections from the ImageDirector Capture process to the approved server list.
• Deploy application allowlisting and configuration management tooling to enforce a known-good Server value across endpoints.

# Configuration example: restrict outbound destinations for the client
# (Windows Defender Firewall - PowerShell)
New-NetFirewallRule -DisplayName "ImageDirector Capture - Allow Approved Server" `
  -Direction Outbound `
  -Program "C:\Program Files\Milner\ImageDirector Capture\Capture.exe" `
  -RemoteAddress 10.0.0.10 `
  -Action Allow

New-NetFirewallRule -DisplayName "ImageDirector Capture - Block Other" `
  -Direction Outbound `
  -Program "C:\Program Files\Milner\ImageDirector Capture\Capture.exe" `
  -Action Block