CVE-2025-26789

Executive Summary

CVE-2025-26789 is a vulnerability in Logpoint AgentX prior to version 1.5.0. The issue stems from limited access controls, which allows users with the li-admin role to access sensitive information about the AgentX Manager within a Logpoint deployment. This could lead to unauthorized disclosure of configuration details, credentials, or other sensitive data, potentially enabling further lateral movement or privilege escalation within the environment.

Affected Component: Logpoint AgentX (versions < 1.5.0) Attack Vector: Local or authenticated network access (requires li-admin credentials) Impact: Confidentiality breach (sensitive information disclosure)

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Logpoint component (AgentX). The risk is limited to organizations that deploy Logpoint and have granted li-admin roles to users.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which likely indicates that a full CVSS vector has not been assigned yet. However, based on the description, a reasonable assessment would be:

• Attack Vector (AV): Local (L) – requires authenticated access to the Logpoint system.
• Attack Complexity (AC): Low (L) – no special conditions beyond having li-admin credentials.
• Privileges Required (PR): Low (L) – the attacker already has li-admin privileges.
• User Interaction (UI): None (N) – no user interaction required.
• Scope (S): Unchanged (U) – the vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) – sensitive information about AgentX Manager is exposed.
• Integrity (I): None (N) – no data modification.
• Availability (A): None (N) – no denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 5.5 (Medium)

Threat Level: Medium. The vulnerability requires authenticated access with li-admin privileges, limiting the attack surface to internal users or compromised accounts.

Deep Dive & Mechanics

The vulnerability lies in the access control mechanisms of Logpoint AgentX. The li-admin role, intended for administrative tasks, was granted excessive permissions that allowed reading sensitive configuration data from the AgentX Manager. This data could include:

• Connection strings and API keys for the AgentX Manager.
• Internal network topology information.
• Credentials for other Logpoint components.
• Log source configurations.

The flaw is a classic case of CWE-284: Improper Access Control, where the principle of least privilege was not enforced. The li-admin role should have been restricted to only the necessary operations, but instead, it had read access to sensitive manager-level data.

Attack Scenario:

1. An attacker gains access to a Logpoint system with li-admin credentials (e.g., through phishing, credential theft, or insider threat).
2. The attacker queries the AgentX Manager API or reads configuration files that are accessible to the li-admin role.
3. The attacker extracts sensitive information, such as credentials for the AgentX Manager or other Logpoint services.
4. The attacker uses this information to pivot to the AgentX Manager or other systems, escalating privileges or exfiltrating data.

Vulnerable vs. Patched Code

Since this is a proprietary Logpoint component, specific code snippets are not publicly available. However, the fix in version 1.5.0 likely involved:

• Vulnerable (pre-1.5.0): The li-admin role had unrestricted read access to AgentX Manager configuration endpoints or files.
• Patched (1.5.0+): The access control lists were tightened to restrict li-admin from reading sensitive manager data. Only a higher-privileged role (e.g., superadmin) can access this information.

Conceptual Example (Pseudocode):

# Vulnerable code (pre-1.5.0)
def get_manager_config(user):
    if user.role in ["li-admin", "superadmin"]:
        return read_sensitive_config()
    else:
        return "Access denied"

# Patched code (1.5.0+)
def get_manager_config(user):
    if user.role == "superadmin":
        return read_sensitive_config()
    else:
        return "Access denied"

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Logpoint system with an li-admin account.
• Network connectivity to the AgentX Manager (typically on a local network).

Steps:

1. Authenticate to the Logpoint web interface or API using li-admin credentials.
2. Enumerate the AgentX Manager endpoints. For example:

   curl -k -u "li-admin:password" https://logpoint-server:8443/agentx/api/v1/manager/config
   

3. Extract sensitive data from the response, such as API keys or database credentials.
4. Use the extracted credentials to access the AgentX Manager directly or other Logpoint components.

Example Exploit Script (Bash):

#!/bin/bash
# Exploit CVE-2025-26789 - Extract AgentX Manager config
LOGPOINT_HOST="https://logpoint-server:8443"
USERNAME="li-admin"
PASSWORD="password"

echo "[*] Authenticating and extracting config..."
curl -s -k -u "$USERNAME:$PASSWORD" "$LOGPOINT_HOST/agentx/api/v1/manager/config" -o manager_config.json
cat manager_config.json | jq '.'

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual API calls to /agentx/api/v1/manager/config or similar endpoints from li-admin users.
• Alert on multiple failed authentication attempts followed by successful access to sensitive endpoints.
• Use the Sigma rule below to detect exploitation attempts.

Defense:

• Immediately upgrade to Logpoint AgentX 1.5.0 or later.
• Review and restrict li-admin role assignments. Ensure only necessary users have this role.
• Implement network segmentation to limit access to the AgentX Manager.
• Enable logging and auditing for all administrative actions.

Indicators of Compromise (IOCs)

• Network Indicators:
  • HTTP requests to /agentx/api/v1/manager/config or similar paths.
  • Unusual outbound connections from Logpoint servers to unknown IPs (data exfiltration).
• File Indicators:
  • Unexpected presence of manager_config.json or similar files on the system.
• User Behavior:
  • li-admin users accessing endpoints they normally do not use.
  • Multiple li-admin accounts performing similar reconnaissance actions.

Detection Engineering

YARA Rule

rule CVE_2025_26789_Logpoint_AgentX_Config_Access {
    meta:
        description = "Detects attempts to access Logpoint AgentX Manager config by li-admin users"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26789"
        severity = "medium"
    strings:
        $s1 = "/agentx/api/v1/manager/config" ascii wide nocase
        $s2 = "li-admin" ascii wide nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: CVE-2025-26789 - Logpoint AgentX Manager Config Access by li-admin
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects when a li-admin user accesses the AgentX Manager configuration endpoint.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-26789
author: Valters IT
date: 2025-04-10
logsource:
    product: logpoint
    service: web
detection:
    selection:
        http.url|contains: "/agentx/api/v1/manager/config"
        http.user_agent|contains: "curl"  # Adjust based on actual client
        user.role: "li-admin"
    condition: selection
falsepositives:
    - Legitimate administrative tasks by authorized personnel
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-26789 - Logpoint AgentX Manager Config Access Attempt";
    flow:to_server,established;
    content:"/agentx/api/v1/manager/config"; http_uri;
    content:"li-admin"; http_cookie;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-26789;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Logpoint AgentX to version 1.5.0 or later. This is the only official patch.
2. Review all li-admin role assignments and remove any unnecessary accounts.
3. Rotate any credentials that may have been exposed (e.g., AgentX Manager API keys).

Long-Term Mitigations:

• Implement the principle of least privilege for all Logpoint roles.
• Enable comprehensive logging and monitoring for all administrative actions.
• Conduct regular security audits of Logpoint configurations.
• Use network segmentation to isolate the AgentX Manager from less trusted networks.

Workarounds (if patching is not immediately possible):

• Restrict network access to the AgentX Manager API to only trusted IPs.
• Temporarily disable the li-admin role or reduce its permissions via custom role configuration (if supported by Logpoint).

Valters IT