CVE-2025-7024 Overview
CVE-2025-7024 is an Incorrect Default Permissions vulnerability [CWE-276] in the AIRBUS PSS TETRA Connectivity Server running on Windows Server. The flaw exists in version 7.0 of the TETRA Connectivity Server. An attacker with local access can execute arbitrary code with SYSTEM privileges if a user is tricked or directed to place a crafted file into the vulnerable directory. The issue stems from insecure access control lists on a directory used by the service. Airbus has issued a fix and delivered it to impacted customers.
Critical Impact
Successful exploitation grants SYSTEM-level code execution on Windows Server hosts running the TETRA Connectivity Server, fully compromising confidentiality, integrity, and availability of the service.
Affected Products
- AIRBUS PSS TETRA Connectivity Server 7.0
- Deployments running on Windows Server operating systems
- Environments using PSS TETRA radio dispatch and connectivity infrastructure
Discovery Timeline
- 2026-04-03 - CVE-2025-7024 published to NVD
- 2026-04-03 - Last updated in NVD database
Technical Details for CVE-2025-7024
Vulnerability Analysis
The vulnerability is classified as Incorrect Default Permissions [CWE-276]. The TETRA Connectivity Server installs a directory on Windows Server with weak access control settings. Low-privileged users can write files into that directory. The TETRA service runs with SYSTEM privileges and loads or executes content from the affected location. An attacker who places a crafted file into the directory can have it executed under the service account context. The attack requires local access and user interaction, which limits remote exploitation but enables full privilege escalation from a standard user account.
Root Cause
The root cause is improper assignment of file system permissions during installation. The installer fails to restrict write access on a directory consumed by a SYSTEM-level service process. Standard Windows least-privilege principles for service directories are not enforced, allowing non-administrative users to modify content that is later trusted by the service.
Attack Vector
The attack vector is local. An adversary first obtains low-privileged code execution on the Windows Server host. The attacker then places a crafted payload into the writable service directory. When a user is tricked or directed into triggering the service action, the TETRA service consumes the planted file. The payload executes under the SYSTEM account, yielding full host compromise. No verified public proof-of-concept is currently available.
No verified exploit code is available for CVE-2025-7024. See the MITRE CWE-276 Definition for background on the underlying weakness class.
Detection Methods for CVE-2025-7024
Indicators of Compromise
- Unexpected executable or script files written to TETRA Connectivity Server installation directories by non-administrative users.
- New child processes spawned by the TETRA service running under the SYSTEM account that do not match the vendor-supplied binary set.
- Modifications to configuration files, DLLs, or scheduled job artifacts inside the TETRA service directory outside vendor patch windows.
Detection Strategies
- Audit NTFS access control lists on TETRA Connectivity Server directories and flag any path where the Users or Authenticated Users group has write permissions.
- Enable Windows Security Event ID 4663 for file create and modify events within the TETRA installation tree.
- Correlate file write events from low-privileged users with subsequent process creation events (Event ID 4688) where the parent process is the TETRA service.
Monitoring Recommendations
- Forward Windows Sysmon and Security logs from TETRA hosts to a centralized SIEM for behavioral correlation.
- Establish a baseline of legitimate binaries and configuration files inside the TETRA directory and alert on deviations.
- Monitor service account behavior for anomalous outbound network connections or credential access patterns following file modifications.
How to Mitigate CVE-2025-7024
Immediate Actions Required
- Contact Airbus to obtain and deploy the vendor-supplied fix for TETRA Connectivity Server 7.0.
- Restrict directory permissions on the TETRA installation path so only SYSTEM and Administrators retain write access.
- Limit interactive and remote logon rights on Windows Server hosts running TETRA Connectivity Server to administrative users only.
- Apply application allowlisting on TETRA hosts to block unsigned binaries from executing under the service context.
Patch Information
Airbus states that a vulnerability fix is available and has been delivered to impacted customers. Operators of PSS TETRA Connectivity Server 7.0 should engage their Airbus support channel to confirm receipt and successful deployment of the patch. Verify the fix by reviewing the directory ACLs after installation and confirming that non-privileged write access has been removed.
Workarounds
- Manually tighten ACLs on the affected TETRA directory using icacls to remove write permissions for non-administrative principals.
- Isolate TETRA Connectivity Server hosts on a dedicated management VLAN and restrict logon to a small set of vetted operators.
- Enforce multi-factor authentication for administrative access to reduce the risk of a low-privileged foothold escalating via this flaw.
# Example: remove write access for non-admin users on the TETRA directory
icacls "C:\Program Files\Airbus\PSS TETRA Connectivity Server" /inheritance:r
icacls "C:\Program Files\Airbus\PSS TETRA Connectivity Server" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"
icacls "C:\Program Files\Airbus\PSS TETRA Connectivity Server" /grant:r "Users:(OI)(CI)RX"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
