The SentinelOne Annual Threat Report - A Defenders Guide from the FrontlinesThe SentinelOne Annual Threat ReportGet the Report
Experiencing a Breach?Blog
Get StartedContact Us
SentinelOne
  • Platform
    Platform Overview
    • Singularity Platform
      Welcome to Integrated Enterprise Security
    • AI for Security
      Leading the Way in AI-Powered Security Solutions
    • Securing AI
      Accelerate AI Adoption with Secure AI Tools, Apps, and Agents.
    • How It Works
      The Singularity XDR Difference
    • Singularity Marketplace
      One-Click Integrations to Unlock the Power of XDR
    • Pricing & Packaging
      Comparisons and Guidance at a Glance
    Data & AI
    • Purple AI
      Accelerate SecOps with Generative AI
    • Singularity Hyperautomation
      Easily Automate Security Processes
    • AI-SIEM
      The AI SIEM for the Autonomous SOC
    • AI Data Pipelines
      Security Data Pipeline for AI SIEM and Data Optimization
    • Singularity Data Lake
      AI-Powered, Unified Data Lake
    • Singularity Data Lake for Log Analytics
      Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
    Endpoint Security
    • Singularity Endpoint
      Autonomous Prevention, Detection, and Response
    • Singularity XDR
      Native & Open Protection, Detection, and Response
    • Singularity RemoteOps Forensics
      Orchestrate Forensics at Scale
    • Singularity Threat Intelligence
      Comprehensive Adversary Intelligence
    • Singularity Vulnerability Management
      Application & OS Vulnerability Management
    • Singularity Identity
      Identity Threat Detection and Response
    Cloud Security
    • Singularity Cloud Security
      Block Attacks with an AI-Powered CNAPP
    • Singularity Cloud Native Security
      Secure Cloud and Development Resources
    • Singularity Cloud Workload Security
      Real-Time Cloud Workload Protection Platform
    • Singularity Cloud Data Security
      AI-Powered Threat Detection for Cloud Storage
    • Singularity Cloud Security Posture Management
      Detect and Remediate Cloud Misconfigurations
    Securing AI
    • Prompt Security
      Secure AI Tools Across Your Enterprise
  • Why SentinelOne?
    Why SentinelOne?
    • Why SentinelOne?
      Cybersecurity Built for What’s Next
    • Our Customers
      Trusted by the World’s Leading Enterprises
    • Industry Recognition
      Tested and Proven by the Experts
    • About Us
      The Industry Leader in Autonomous Cybersecurity
    Compare SentinelOne
    • Arctic Wolf
    • Broadcom
    • CrowdStrike
    • Cybereason
    • Microsoft
    • Palo Alto Networks
    • Sophos
    • Splunk
    • Trellix
    • Trend Micro
    • Wiz
    Verticals
    • Energy
    • Federal Government
    • Finance
    • Healthcare
    • Higher Education
    • K-12 Education
    • Manufacturing
    • Retail
    • State and Local Government
  • Services
    Managed Services
    • Managed Services Overview
      Wayfinder Threat Detection & Response
    • Threat Hunting
      World-Class Expertise and Threat Intelligence
    • Managed Detection & Response
      24/7/365 Expert MDR Across Your Entire Environment
    • Incident Readiness & Response
      DFIR, Breach Readiness, & Compromise Assessments
    Support, Deployment, & Health
    • Technical Account Management
      Customer Success with Personalized Service
    • SentinelOne GO
      Guided Onboarding & Deployment Advisory
    • SentinelOne University
      Live and On-Demand Training
    • Services Overview
      Comprehensive Solutions for Seamless Security Operations
    • SentinelOne Community
      Community Login
  • Partners
    Our Network
    • MSSP Partners
      Succeed Faster with SentinelOne
    • Singularity Marketplace
      Extend the Power of S1 Technology
    • Cyber Risk Partners
      Enlist Pro Response and Advisory Teams
    • Technology Alliances
      Integrated, Enterprise-Scale Solutions
    • SentinelOne for AWS
      Hosted in AWS Regions Around the World
    • Channel Partners
      Deliver the Right Solutions, Together
    • SentinelOne for Google Cloud
      Unified, Autonomous Security Giving Defenders the Advantage at Global Scale
    • Partner Locator
      Your Go-to Source for Our Top Partners in Your Region
    Partner Portal→
  • Resources
    Resource Center
    • Case Studies
    • Data Sheets
    • eBooks
    • Reports
    • Videos
    • Webinars
    • Whitepapers
    • Events
    View All Resources→
    Blog
    • Feature Spotlight
    • For CISO/CIO
    • From the Front Lines
    • Identity
    • Cloud
    • macOS
    • SentinelOne Blog
    Blog→
    Tech Resources
    • SentinelLABS
    • Ransomware Anthology
    • Cybersecurity 101
  • About
    About SentinelOne
    • About SentinelOne
      The Industry Leader in Cybersecurity
    • Investor Relations
      Financial Information & Events
    • SentinelLABS
      Threat Research for the Modern Threat Hunter
    • Careers
      The Latest Job Opportunities
    • Press & News
      Company Announcements
    • Cybersecurity Blog
      The Latest Cybersecurity Threats, News, & More
    • FAQ
      Get Answers to Our Most Frequently Asked Questions
    • DataSet
      The Live Data Platform
    • S Foundation
      Securing a Safer Future for All
    • S Ventures
      Investing in the Next Generation of Security, Data and AI
  • Pricing
Get StartedContact Us
CVE Vulnerability Database
Vulnerability Database/CVE-2025-7024

CVE-2025-7024: AIRBUS PSS TETRA Privilege Escalation Flaw

CVE-2025-7024 is a privilege escalation vulnerability in AIRBUS PSS TETRA Connectivity Server that allows attackers to execute code with SYSTEM privileges. This article covers technical details, affected versions, and mitigation.

Updated: May 14, 2026

CVE-2025-7024 Overview

CVE-2025-7024 is an Incorrect Default Permissions vulnerability [CWE-276] in the AIRBUS PSS TETRA Connectivity Server running on Windows Server. The flaw exists in version 7.0 of the TETRA Connectivity Server. An attacker with local access can execute arbitrary code with SYSTEM privileges if a user is tricked or directed to place a crafted file into the vulnerable directory. The issue stems from insecure access control lists on a directory used by the service. Airbus has issued a fix and delivered it to impacted customers.

Critical Impact

Successful exploitation grants SYSTEM-level code execution on Windows Server hosts running the TETRA Connectivity Server, fully compromising confidentiality, integrity, and availability of the service.

Affected Products

  • AIRBUS PSS TETRA Connectivity Server 7.0
  • Deployments running on Windows Server operating systems
  • Environments using PSS TETRA radio dispatch and connectivity infrastructure

Discovery Timeline

  • 2026-04-03 - CVE-2025-7024 published to NVD
  • 2026-04-03 - Last updated in NVD database

Technical Details for CVE-2025-7024

Vulnerability Analysis

The vulnerability is classified as Incorrect Default Permissions [CWE-276]. The TETRA Connectivity Server installs a directory on Windows Server with weak access control settings. Low-privileged users can write files into that directory. The TETRA service runs with SYSTEM privileges and loads or executes content from the affected location. An attacker who places a crafted file into the directory can have it executed under the service account context. The attack requires local access and user interaction, which limits remote exploitation but enables full privilege escalation from a standard user account.

Root Cause

The root cause is improper assignment of file system permissions during installation. The installer fails to restrict write access on a directory consumed by a SYSTEM-level service process. Standard Windows least-privilege principles for service directories are not enforced, allowing non-administrative users to modify content that is later trusted by the service.

Attack Vector

The attack vector is local. An adversary first obtains low-privileged code execution on the Windows Server host. The attacker then places a crafted payload into the writable service directory. When a user is tricked or directed into triggering the service action, the TETRA service consumes the planted file. The payload executes under the SYSTEM account, yielding full host compromise. No verified public proof-of-concept is currently available.

No verified exploit code is available for CVE-2025-7024. See the MITRE CWE-276 Definition for background on the underlying weakness class.

Detection Methods for CVE-2025-7024

Indicators of Compromise

  • Unexpected executable or script files written to TETRA Connectivity Server installation directories by non-administrative users.
  • New child processes spawned by the TETRA service running under the SYSTEM account that do not match the vendor-supplied binary set.
  • Modifications to configuration files, DLLs, or scheduled job artifacts inside the TETRA service directory outside vendor patch windows.

Detection Strategies

  • Audit NTFS access control lists on TETRA Connectivity Server directories and flag any path where the Users or Authenticated Users group has write permissions.
  • Enable Windows Security Event ID 4663 for file create and modify events within the TETRA installation tree.
  • Correlate file write events from low-privileged users with subsequent process creation events (Event ID 4688) where the parent process is the TETRA service.

Monitoring Recommendations

  • Forward Windows Sysmon and Security logs from TETRA hosts to a centralized SIEM for behavioral correlation.
  • Establish a baseline of legitimate binaries and configuration files inside the TETRA directory and alert on deviations.
  • Monitor service account behavior for anomalous outbound network connections or credential access patterns following file modifications.

How to Mitigate CVE-2025-7024

Immediate Actions Required

  • Contact Airbus to obtain and deploy the vendor-supplied fix for TETRA Connectivity Server 7.0.
  • Restrict directory permissions on the TETRA installation path so only SYSTEM and Administrators retain write access.
  • Limit interactive and remote logon rights on Windows Server hosts running TETRA Connectivity Server to administrative users only.
  • Apply application allowlisting on TETRA hosts to block unsigned binaries from executing under the service context.

Patch Information

Airbus states that a vulnerability fix is available and has been delivered to impacted customers. Operators of PSS TETRA Connectivity Server 7.0 should engage their Airbus support channel to confirm receipt and successful deployment of the patch. Verify the fix by reviewing the directory ACLs after installation and confirming that non-privileged write access has been removed.

Workarounds

  • Manually tighten ACLs on the affected TETRA directory using icacls to remove write permissions for non-administrative principals.
  • Isolate TETRA Connectivity Server hosts on a dedicated management VLAN and restrict logon to a small set of vetted operators.
  • Enforce multi-factor authentication for administrative access to reduce the risk of a low-privileged foothold escalating via this flaw.
bash
# Example: remove write access for non-admin users on the TETRA directory
icacls "C:\Program Files\Airbus\PSS TETRA Connectivity Server" /inheritance:r
icacls "C:\Program Files\Airbus\PSS TETRA Connectivity Server" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"
icacls "C:\Program Files\Airbus\PSS TETRA Connectivity Server" /grant:r "Users:(OI)(CI)RX"

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

  • Vulnerability Details
  • TypePrivilege Escalation

  • Vendor/TechAirbus Pss Tetra

  • SeverityMEDIUM

  • CVSS Score5.6

  • EPSS Probability0.01%

  • Known ExploitedNo
  • CVSS Vector
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • Impact Assessment
  • ConfidentialityLow
  • IntegrityHigh
  • AvailabilityHigh
  • CWE References
  • CWE-276
  • Technical References
  • MITRE CWE-276 Definition
  • Latest CVEs
  • CVE-2026-46333: Linux Kernel Privilege Escalation Flaw

  • CVE-2026-2586: Eclipse Glassfish RCE Vulnerability

  • CVE-2026-2587: Eclipse Glassfish RCE Vulnerability

  • CVE-2026-45255: FreeBSD bsdinstall/bsdconfig RCE Flaw
Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne
  • Get Started
  • Get a Demo
  • Product Tour
  • Why SentinelOne
  • Pricing & Packaging
  • FAQ
  • Contact
  • Contact Us
  • Customer Support
  • SentinelOne Status
  • Language
  • Platform
  • Singularity Platform
  • Singularity Endpoint
  • Singularity Cloud
  • Singularity AI-SIEM
  • Singularity Identity
  • Singularity Marketplace
  • Purple AI
  • Services
  • Wayfinder TDR
  • SentinelOne GO
  • Technical Account Management
  • Support Services
  • Verticals
  • Energy
  • Federal Government
  • Finance
  • Healthcare
  • Higher Education
  • K-12 Education
  • Manufacturing
  • Retail
  • State and Local Government
  • Cybersecurity for SMB
  • Resources
  • Blog
  • Labs
  • Case Studies
  • Videos
  • Product Tours
  • Events
  • Cybersecurity 101
  • eBooks
  • Webinars
  • Whitepapers
  • Press
  • News
  • Ransomware Anthology
  • Company
  • About Us
  • Our Customers
  • Careers
  • Partners
  • Legal & Compliance
  • Security & Compliance
  • Investor Relations
  • S Foundation
  • S Ventures

©2026 SentinelOne, All Rights Reserved.

Privacy Notice Terms of Use

English