Security readout for executives and security teams
Plain-English summary
This is a local bypass of the Auto Lock feature in Mirmay Secure Private Browser and File Manager versions 2.0 through 2.5. Someone with local access and an existing low-privileged foothold could potentially view protected browser or file-manager content. The business impact is limited confidentiality loss, not remote compromise or system takeover.
Executive priority
Treat this as a low-priority endpoint hygiene issue unless these apps are widely used for sensitive files or shared-device privacy. It is not described as remotely exploitable, but public disclosure raises the need to identify and phase out affected versions.
Technical view
CVE-2018-25030 is CWE-287 improper authentication caused by a race condition in Auto Lock. CVSS 3.1 is 3.3 with AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating local, low-complexity exploitation requiring privileges and no user interaction, with confidentiality-only impact. Sources identify versions 2.0-2.5 of both products.
Likely exposure
Exposure is limited to endpoints where Mirmay Secure Private Browser or Mirmay File Manager versions 2.0-2.5 are installed and used to protect sensitive local content. Server-side and internet-facing exposure is not indicated by the sources.
Exploitation context
The source bundle says the exploit was publicly disclosed and may be used. It does not show CISA KEV listing or cited evidence of active exploitation in the wild, so active exploitation should not be asserted.
Researcher notes
Evidence is concise and limited. The vulnerability is a local authentication bypass in Auto Lock, mapped to CWE-287, affecting two Mirmay products through version 2.5. No patch version, vendor advisory, or active exploitation evidence is included in the provided sources.
Mitigation direction
- Inventory endpoints for affected Mirmay apps and versions 2.0 through 2.5.
- Check Mirmay or app-store guidance for fixed versions or vendor-recommended mitigation.
- Remove the apps where they are unnecessary or unsupported.
- Avoid relying on Auto Lock as the only control for sensitive local content.
- Use device-level encryption and OS screen locking for stronger local protection.
Validation and detection
- Confirm installed app names and versions on managed endpoints.
- Verify whether protected content depends on the affected Auto Lock feature.
- Review vendor or app-store metadata for available updates or replacement guidance.
- Prioritize devices shared by multiple users or handling confidential local files.
- Document compensating controls for any device that cannot be updated or retired.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-25030 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N1.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.3LowVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://vuldb.com/?id.106056CVE reference · x_refsource_MISC
- https://youtu.be/cd6nbos-BI0CVE reference · x_refsource_MISC
- https://www.scip.ch/en/?labs.20180201CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authentication
Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.