CVE-2025-58079 Details
Description
Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applications.
A vulnerability allowing attackers to create malicious AppSuite applications has been identified in desknet's NEO versions 4.0R1.0 through 9.0R2.0. This issue arises from improper protection of alternate paths, which could be exploited by remote authenticated attackers.
Users are advised to update desknet's NEO to version 9.5 R1.0 or later. For those using the PostgreSQL or SQL Server versions, download and install the update module. Oracle version users should contact NEOJAPAN for guidance.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2025CISA-ADP
Assessed Oct 16, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jvn.jp/en/jp/JVN90757550/ | [email protected] | AdvisoryBundleRemedy |
| https://www.desknets.com/neo/support/mainte/17475/ | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-424 | Improper Protection of Alternate Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NEOJAPAN desknet's NEO | >= V4.0R1.0, <= V9.0R2.0 |
CPE
Remediation
| |
| NEOJAPAN AppSuite | All versions |
CPE
Remediation
| |
| NEOJAPAN desknet's Web Server | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2025 | New CVE Received | [email protected] |