Description
The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of WPS Office did not validate the update server's certificate, an Adversary-In-The-Middle attack was possible allowing updates to be hijacked.
INFO
Published Date :
2025-03-27T14:29:22.907Z
Last Modified :
2025-03-27T15:15:56.127Z
Source :
ESET
AFFECTED PRODUCTS
The following products are affected by CVE-2025-2516 vulnerability.
| Vendors | Products |
|---|---|
| Kingsoft |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-2516.
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability