Security readout for executives and security teams
Plain-English summary
CVE-2020-25564 is reported to let a non-privileged SapphireIMS 5.0 user create a local administrator account on client systems by directly accessing an automation task feature. For organizations using SapphireIMS, this could turn ordinary application access into administrative control over endpoints.
Executive priority
Treat this as high priority if SapphireIMS 5.0 is present, because the reported impact is endpoint administrator creation from low-privilege application access. If SapphireIMS is not deployed, business exposure is likely negligible.
Technical view
The source describes an authorization weakness in SapphireIMS 5.0 where RemoteMgmtTaskSave, part of Automation Tasks, can be accessed directly by a non-privileged authenticated user to create local administrators on clients. Public CVE metadata provides no CVSS score, CWE, affected CPEs, vendor fix, or official mitigation details.
Likely exposure
Exposure appears limited to environments running SapphireIMS 5.0 with users who can authenticate to the application. The bundle does not identify other affected versions, deployment requirements, internet exposure, or whether default configurations are vulnerable.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. Public references describe the vulnerability behavior, but the provided evidence is insufficient to claim real-world exploitation or widespread scanning.
Researcher notes
Key gaps remain: no CVSS vector, CWE, CPE, official vendor advisory, patch version, or exploitation confirmation appears in the provided bundle. Analysis should stay tied to SapphireIMS 5.0 and the RemoteMgmtTaskSave Automation Tasks behavior only.
Mitigation direction
- Check official SapphireIMS vendor guidance for patches or supported upgrade paths.
- Restrict SapphireIMS access to trusted administrators and management networks.
- Review permissions around Automation Tasks and RemoteMgmtTaskSave access.
- Audit client systems for unexpected local administrator accounts.
- Monitor SapphireIMS activity for unusual automation task creation.
Validation and detection
- Inventory whether SapphireIMS 5.0 is deployed in the environment.
- Confirm which users can authenticate to SapphireIMS.
- Review logs for non-administrative users creating automation tasks.
- Compare client local administrator accounts against approved baselines.
- Document any compensating access controls around the SapphireIMS console.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-25564 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://vuln.shellcoder.party/tags/sapphireims/CVE reference · x_refsource_MISC
- https://vuln.shellcoder.party/2020/09/19/cve-2020-25564-sapphireims-unprivileged-user-remote-command-execution-create-local-admin-on-clients/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.