CVE-2025-5471 - Vulnerability Details - OpenCVE

Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Apple	Macos
Yandex	Yandex Telemost

No data.

No data.

References

Link	Providers
https://yandex.com/bugbounty/i/hall-of-fame-products

History

Wed, 10 Dec 2025 18:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Yandex Yandex yandex Telemost
Vendors & Products		Apple Apple macos Yandex Yandex yandex Telemost

Tue, 09 Dec 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 09 Dec 2025 16:00:00 +0000

Type	Values Removed	Values Added
Description		Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1.
Title		Dylib Hijacking in Yandex Telemost
Weaknesses		CWE-427
References		https://yandex.com/bugbounty/i/hall-of-fame-products
Metrics		cvssV4_0 `{'score': 7.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/R:A/U:Amber'}`

MITRE

Status: PUBLISHED

Assigner: yandex

Published: 2025-12-09T15:53:23.306Z

Updated: 2025-12-09T16:12:18.303Z

Reserved: 2025-06-02T12:52:20.730Z

Link: CVE-2025-5471

Vulnrichment

Updated: 2025-12-09T16:12:14.490Z

NVD

Status : Awaiting Analysis

Published: 2025-12-09T16:17:59.817

Modified: 2025-12-09T18:36:53.557

Link: CVE-2025-5471

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5471", "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796", "state": "PUBLISHED", "assignerShortName": "yandex", "dateReserved": "2025-06-02T12:52:20.730Z", "datePublished": "2025-12-09T15:53:23.306Z", "dateUpdated": "2025-12-09T16:12:18.303Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "Telemost", "vendor": "Yandex", "versions": [{"lessThan": "2.19.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Egor Filatov, Positive Technologies"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.<p>This issue affects Telemost: before 2.19.1.</p>"}], "value": "Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1."}], "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "AUTOMATIC", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 7.3, "baseSeverity": "HIGH", "exploitMaturity": "PROOF_OF_CONCEPT", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/R:A/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a51c9250-e584-488d-808b-03e6f1386796", "shortName": "yandex", "dateUpdated": "2025-12-09T15:53:23.306Z"}, "references": [{"url": "https://yandex.com/bugbounty/i/hall-of-fame-products"}], "source": {"discovery": "EXTERNAL"}, "title": "Dylib Hijacking in Yandex Telemost", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-09T16:12:07.201918Z", "id": "CVE-2025-5471", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T16:12:18.303Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5471", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-09T16:12:07.201918Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T16:12:14.490Z"}}], "cna": {"title": "Dylib Hijacking in Yandex Telemost", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Egor Filatov, Positive Technologies"}], "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "AUTOMATIC", "baseScore": 7.3, "Automatable": "YES", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/R:A/U:Amber", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Yandex", "product": "Telemost", "versions": [{"status": "affected", "version": "0", "lessThan": "2.19.1", "versionType": "custom"}], "platforms": ["MacOS"], "defaultStatus": "unaffected"}], "references": [{"url": "https://yandex.com/bugbounty/i/hall-of-fame-products"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1.", "supportingMedia": [{"type": "text/html", "value": "Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.<p>This issue affects Telemost: before 2.19.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "a51c9250-e584-488d-808b-03e6f1386796", "shortName": "yandex", "dateUpdated": "2025-12-09T15:53:23.306Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5471", "state": "PUBLISHED", "dateUpdated": "2025-12-09T16:12:18.303Z", "dateReserved": "2025-06-02T12:52:20.730Z", "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796", "datePublished": "2025-12-09T15:53:23.306Z", "assignerShortName": "yandex"}, "dataVersion": "5.2"}