This vulnerability (CVE-2025-7024) involves incorrect default permissions in AIRBUS TETRA Connectivity Server 7.0 on Windows Server. Due to these permissions, an attacker can abuse privileges by convincing a user to place a maliciously crafted file into a specific directory, which can lead to arbitrary code execution with SYSTEM-level privileges. The CVSS 4.0 vector indicates local attack vector with low attack complexity, no attack prerequisites, requiring user interaction, and high impact on confidentiality, integrity, and availability. The vendor has provided a fix to affected customers.

Successful exploitation allows an attacker to execute arbitrary code with SYSTEM privileges on the affected system, potentially leading to full control over the TETRA Connectivity Server environment. This could compromise confidentiality, integrity, and availability of the system. However, exploitation requires local access and user interaction to place the crafted file, limiting the attack surface.

A vulnerability fix is available and has been delivered to impacted customers by AIRBUS. Users of TETRA Connectivity Server version 7.0 should apply the official patch or update provided by AIRBUS to remediate this issue. Since the vendor advisory indicates the fix is delivered, no additional mitigation steps are required beyond applying the patch.