What is CVE-2025-10644?

CVE-2025-10644 is a critical-severity vulnerability in Wondershare Repairit, classified under Incorrect Privilege Assignment. CVSS score: 9.4/10. Published 2025-09-17.

How severe is CVE-2025-10644?

Critical severity. CVSS v3 base score is 9.4 out of 10.

Privilege escalation in Wondershare Repairit

CVE-2025-10644

Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on Wondershare Repairit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the permissions granted to an SAS token. An attacker can leverage this vulnerability to launch a supply-chain attack and execute arbitrary code on customers' endpoints. Was ZDI-CAN-26892.

EPSS: 0.037 (88.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.4 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.

Affected products

Wondershare Repairit — versions 6.5.2

Weakness classification (CWE)

CWE-266 — Incorrect Privilege Assignment

References

zdi-disclosures@trendmicro.com (x_research-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2025-10644?: CVE-2025-10644 is a critical-severity vulnerability in Wondershare Repairit, classified under Incorrect Privilege Assignment. CVSS score: 9.4/10. Published 2025-09-17.
How severe is CVE-2025-10644?: Critical severity. CVSS v3 base score is 9.4 out of 10.