This vulnerability, identified as CVE-2025-1161 and categorized under CWE-648 (Incorrect Use of Privileged APIs), affects the Nomysem product by NomySoft Information Technology Training and Consulting Inc. It allows an attacker with limited privileges to escalate their privileges due to improper handling of privileged API calls. The CVSS v3.1 base score is 7.1, reflecting network attack vector, high complexity, required user interaction, and significant impact on confidentiality, integrity, and availability. The vulnerability is published and reserved in 2025, but no patch or vendor advisory is currently available.

Successful exploitation of this vulnerability can lead to privilege escalation, allowing an attacker with limited privileges to gain higher-level access. This can compromise the confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild, but the high CVSS score indicates a serious risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, monitor vendor communications for updates. Until a fix is released, consider restricting access to affected versions of Nomysem and applying any available workarounds recommended by the vendor once published.