Vulnerability Intelligence Report
Telerik Report Server Clear Text Transmission of Agent Commands
CVE-2025-0556
In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent process and app host process occurs over an unencrypted tunnel, which can be subjected to local network traffic sniffing.
No Active Exploit Signals
CVSS Base Score
8.8
HIGH
Exploitability:2.9
Impact Score:5.9
EPSS Probability:0.29%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-319 ↗CWE-319: Cleartext Transmission of Sensitive Information
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Progress Software | Telerik Report Server | 1.0.0 < 2025 Q1 (11.0.25.211) (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.285%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Progress Software Corporation · Vendor · USA |
| Reserved | 2025-01-17T19:39:39 |
| Published | 2025-02-12T15:11:03 |
| Last Updated | 2025-02-12T15:33:35 |
Community Chatter & Buzz