CVE-2025-62004 - CVE House

Back to Database

Status published High CVE-2025-62004

BullWall Server Intrusion Protection (SIP) initialization race condition

7.7 CVSS

Vulnerability Description

BullWall Server Intrusion Protection (SIP) services are initialized after login services during system startup. A local, authenticated attacker can log in after boot and before SIP MFA is running. The SIP services do not retroactively enforce MFA or disconnect sessions that were not subject to SIP MFA. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions mayy also be affected. BullWall plans to improve detection method documentation.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62004

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Alexander Nikolaj Fischer

References

More from BullWall

View All →

BullWall Server Intrusion Protection RDP MFA connection delay

BullWall Ransomware Containment file count detection bypass

BullWall Ransomware Containment hard-coded folder exclusions

BullWall Ransomware Containment incomplete file inspection

Affected Vendor

BullWall

View all reports →

Affected Software

Server Intrusion Protection

Vulnerable Versions:

4.6.0.0

Timeline

Official Publish: December 18th, 2025

Last Modified: January 15th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1574 Hijack Execution Flow

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1036 Masquerading

Defense Evasion

T1485 Data Destruction

T1005 Data from Local System