Proget MDM Password Retrieval Vulnerability for Managed Devices

A vulnerability in Proget Mobile Device Management (MDM) allows low-privileged users to retrieve passwords for managed devices, enabling access to functionalities restricted by the MDM. To exploit this vulnerability, users must know the UUIDs of the targeted devices, which can be obtained by exploiting related vulnerabilities, CVE-2025-1415 or CVE-2025-1417. This issue affects all Proget versions prior to 2.17.5.

Impact

Successful exploitation allows low-privileged users to access passwords for managed devices, bypassing MDM restrictions and potentially compromising device security.

Remediation

Users can update to Proget version 2.17.5 or later to address this vulnerability.