CVE-2025-0418 - CVE House
Back to Database
Status published Medium CVE-2025-0418

Valmet DNA user passwords in plain text

Vulnerability Description

Valmet DNA user passwords in plain text. This practice poses a security risk as attackers who gain access to local project data can read the passwords.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-0418

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Sixtus Leonhardsberger and Felix Eberstaller of LimesSecurity

References

More from Valmet

View All →
CVE-2025-15577
Valmet DNA Web server arbitrary file read access
High 8.7
CVE-2025-0417
Valmet DNA Lack of protection against brute force attacks
High 7
CVE-2025-0416
Valmet DNA Local privilege escalation through insecure DCOM configuration
High 8.9

Affected Vendor

Affected Software

Valmet DNA
Vulnerable Versions:
C2007

Timeline

Official Publish: April 1st, 2025
Last Modified: April 1st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-312

MITRE ATT&CK TTPs

T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1530 Data from Cloud Storage
Collection
T1078 Valid Accounts
Persistence
T1041 Exfiltration Over C2 Channel
Exfiltration