CVE-2025-0364 — AI Deep Analysis Summary

🚨 **Essence**: BigAntSoft BigAnt Server has a critical flaw allowing **unauthenticated Remote Code Execution (RCE)**.…

🛡️ **Root Cause**: **CWE-288** (Authentication Bypass). The flaw lies in the **default exposed SaaS registration mechanism**.…

🏢 **Affected**: **BigAntSoft BigAnt Server**. 📦 **Version**: **5.6.06 and earlier**. This is a Windows-hosted on-premises chat solution for business use cases. If you are running this version or older, you are at risk.

💀 **Attacker Capabilities**: With the created admin account, hackers can: 1. **Upload** arbitrary PHP files to the Cloud Storage Add-in. 2. **Execute** this code remotely. 3.…

⚡ **Exploitation Threshold**: **Extremely Low**. 🚫 **Auth**: None required initially. 🎯 **Config**: Relies on the default exposed SaaS registration. 🧩 **Complexity**: Low (just a simple CAPTCHA).…

🔓 **Public Exploit**: **YES**. A PoC is available on GitHub (vulncheck-oss/cve-2025-0364). It demonstrates the full chain: Registration Bypass → Admin Account → PHP Upload → RCE.…

🔍 **Self-Check**: 1. Scan for **BigAntSoft BigAnt Server** services. 2. Check version number (is it ≤ 5.6.06?). 3. Test if the **SaaS registration endpoint** is publicly accessible without strict verification. 4.…

🩹 **Official Fix**: The advisory was published on **2025-02-04**. You must contact **BigAntSoft** immediately for a patched version. Do not rely on third-party fixes; official vendor patches are the only secure solution.

🚧 **No Patch Workaround**: 1. **Block Access**: Restrict the SaaS registration URL to internal IPs only via firewall. 2. **Disable Registration**: If possible, disable the public registration feature entirely. 3.…

🔥 **Urgency**: **CRITICAL / IMMEDIATE ACTION**. With CVSS High severity, low exploitation complexity, and public PoC, this is an **active threat**.…