What’s Vulnerable › Vulnerabilities

CVE-2025-43720

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-21 · updated 2026-06-17
• Weakness: CWE-862

Description

Headwind MDM before 5.33.1 makes configuration details accessible to unauthorized users. The Configuration profile is exposed to the Observer user role, revealing the password requires to escape out of the MDM controlled device's profile.

Affected products

• H-Mdm Headwind Mdm: before 5.33.1 — fixed in 5.33.1

How to fix

Upgrade to a fixed version: H-Mdm Headwind Mdm 5.33.1. Check the vendor advisory for mitigations.

References

• https://github.com/h-mdm/hmdm-server/commit/19e4a63f732c99064444df7e8c61b4f01df362e8
• https://github.com/h-mdm/hmdm-server/compare/v5.32.1...v5.33.1
• https://www.periculo.co.uk/cyber-security-blog/how-our-pen-tester-found-a-critical-vulnerability-cve-2025-43720

Get alerted when CVE-2025-43720 or the next vulnerability affects your stack