CVE-2025-58742: ImageDirector Auth Bypass Vulnerability

CVE-2025-58742 Overview

CVE-2025-58742 is a vulnerability in Milner ImageDirector Capture on Windows that combines insufficiently protected credentials (CWE-522) with improper restriction of communication channel to intended endpoints. The vulnerability exists in the Connection Settings dialog, where an attacker can modify the 'Server' field to redirect client authentication, enabling Adversary-in-the-Middle (AiTM) attacks.

Critical Impact

Attackers with local access can intercept authentication credentials by redirecting the client to a malicious server, potentially compromising confidentiality, integrity, and availability of both the local system and connected downstream systems.

Affected Products

• Milner ImageDirector Capture versions 7.0.9 through 7.6.3.25808 (exclusive)
• Windows operating systems running affected ImageDirector Capture versions

Discovery Timeline

• 2026-01-20 - CVE-2025-58742 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-58742

Vulnerability Analysis

This vulnerability arises from a fundamental design flaw in how Milner ImageDirector Capture handles server connection configuration. The Connection Settings dialog allows users to specify the target server for authentication without adequate validation or protection of the communication channel. This creates an opportunity for attackers with local access to the system to redirect authentication attempts to a malicious server under their control.

The dual nature of this vulnerability—combining credential protection weaknesses with improper channel restrictions—makes it particularly dangerous. When a user's authentication credentials are transmitted to a redirected server, the attacker can capture these credentials for later use or immediately relay them in a man-in-the-middle scenario.

Root Cause

The root cause stems from CWE-522 (Insufficiently Protected Credentials) where the application fails to properly protect credentials during transmission. The Connection Settings dialog does not implement adequate controls to verify server authenticity or restrict modification of the server endpoint. Without proper certificate pinning, channel binding, or configuration lockdown mechanisms, the application trusts whatever server address is configured without validating whether it is the legitimate intended endpoint.

Attack Vector

This vulnerability requires local access to the affected Windows system. An attacker with access to the local machine can modify the server configuration in the Connection Settings dialog to point to a rogue server. When legitimate users subsequently authenticate through the application, their credentials are sent to the attacker-controlled server instead of the legitimate ImageDirector server.

The attack can be executed through several vectors: direct modification of the server field by a malicious insider, persistence mechanisms that alter configuration on startup, or social engineering to convince users to change the server address. Once credentials are captured, the attacker can use them to access the legitimate ImageDirector infrastructure or potentially pivot to other systems where credential reuse may be present.

Detection Methods for CVE-2025-58742

Indicators of Compromise

• Unexpected changes to the server configuration in ImageDirector Capture Connection Settings
• Network traffic from ImageDirector Capture clients directed to unauthorized IP addresses or domains
• Authentication failures logged on the legitimate ImageDirector server when users report successful logins
• Configuration file modifications showing altered server endpoints

Detection Strategies

• Monitor configuration file integrity for ImageDirector Capture installations to detect unauthorized server address changes
• Implement network traffic analysis to identify connections from ImageDirector clients to unexpected destinations
• Deploy endpoint detection rules to alert on suspicious modification of ImageDirector Capture settings
• Correlate authentication logs between client systems and servers to identify discrepancies indicative of credential interception

Monitoring Recommendations

• Enable detailed logging on ImageDirector Capture client systems to track configuration changes
• Implement network segmentation and firewall rules to restrict ImageDirector client communications to approved server endpoints only
• Deploy SentinelOne agents on Windows systems running ImageDirector Capture for real-time behavioral monitoring
• Establish baseline network connection patterns for ImageDirector Capture and alert on deviations

How to Mitigate CVE-2025-58742

Immediate Actions Required

• Upgrade Milner ImageDirector Capture to version 7.6.3.25808 or later immediately
• Audit all ImageDirector Capture installations to verify server configuration integrity
• Implement network-level restrictions to limit ImageDirector client connections to known legitimate servers
• Review and rotate any credentials that may have been exposed through potentially compromised installations

Patch Information

Milner has addressed this vulnerability in ImageDirector Capture version 7.6.3.25808. Organizations should update all affected installations to this version or later. For additional details, refer to the SRA Security Advisories page.

Workarounds

• Implement strict network firewall rules to restrict ImageDirector Capture client connections to approved server IP addresses only
• Use Group Policy or endpoint management tools to lock down ImageDirector Capture configuration files and prevent unauthorized modifications
• Deploy endpoint protection solutions like SentinelOne to monitor for suspicious configuration changes or network behavior
• Consider implementing network monitoring to detect and alert on ImageDirector traffic to unapproved destinations