CVE-2025-60791

MEDIUM
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-60791 has a selected CVSS score of 6.2 (medium); EIP currently links 1 repository PoC.

Description

Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The keys can be obtained by attaching a debugger or analyzing the process/memory dump and then they can be used to activate the software on the same machine without purchasing.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 27, 2025 · Source: CVE List

Proofs of concept

1

Repository PoCs

GitHubSmarttfoxx/CVE-2025-60791Repository PoCby Smarttfoxx2Writeup1 file

741 B

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README file that describes CVE-2025-60791, a cleartext storage of sensitive information vulnerability in Easywork Enterprise 2.1.3.354. It explains that valid license keys remain in process memory after a failed activation and can be extracted via debugging or memory dump analysis. The file contains no executable code, only a textual description and two embedded screenshots.

Backdoor review

No backdoor observed in reviewed code

The artifact contains only a README.md file describing CVE-2025-60791 and displaying two embedded images. No executable code, scripts, commands, or deceptive payloads are present in the reviewed text. The content is purely informational documentation of a known vulnerability.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
Languagesmarkdown
Target softwareEasywork Enterprise
Attack typescleartext storage of sensitive information
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README file that provides a textual description of the CVE-2025-60791 vulnerability and its exploitation method, but it does not contain any executable code, scripts, or tools to perform the exploitation or scanning. It is a technical writeup.

README.md:1-10

Requirements

  • Attach a debugger or analyze a process/memory dump of Easywork Enterprise after a failed activation attempt.README.md:4

Observed behavior

  • The artifact describes that valid device-bound license keys are left in cleartext in process memory after a failed activation attempt.README.md:4
  • The artifact includes two screenshots, but their content is not provided as text evidence.README.md:6-8
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
CVE-2025-60791: Cleartext Storage of Sensitive Information in Memory in Easywork Enterprise 2.1.3.354The README describes the vulnerability and its impact, consistent with the associated CVE record.README.md:2-4
Embedded Image
https://github.com/user-attachments/assets/2d02779e-6810-46ec-9e8e-fb09d155055aImage likely shows a screenshot related to the vulnerability; no executable content is present in the text.README.md:6
Embedded Image
https://github.com/user-attachments/assets/6aaeb592-8c21-4197-afa4-8f860a91fd9eImage likely shows a screenshot related to the vulnerability; no executable content is present in the text.README.md:8
Review boundaries

What the analysis did not establish

  • The artifact contains two embedded screenshots (lines 6 and 8) whose content is not provided as text and therefore could not be analyzed.
  • The analysis is based solely on the supplied text of the README file; no other files from the repository were provided.
  • Only the README.md file was reviewed; the repository may contain other files not included in the evidence packet.
  • The content of the embedded images was not inspected; they could contain text or instructions, but no executable code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3