CVE-2025-7024: Local privilege escalation in Windows Server OS through installed Tetra Connectivity Server (TCS)

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-03 · updated 2026-07-24
Weakness: CWE-276

Description

Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS allows Privilege Abuse. An attacker may execute arbitrary code with SYSTEM privileges if a user is tricked or directed to place a crafted file into the vulnerable directory. This issue affects TETRA connectivity Server: 7.0. Vulnerability fix is available and delivered to impacted customers.

Affected products

AIRBUS TETRA Connectivity Server (TCS): 7.0

References

https://cwe.mitre.org/data/definitions/276.html

Get alerted when CVE-2025-7024 or the next vulnerability affects your stack