This vulnerability (CVE-2025-7024) involves incorrect default permissions in AIRBUS TETRA Connectivity Server 7.0 on Windows Server. Due to these permissions, an attacker can abuse privileges by causing a user to place a maliciously crafted file into a specific directory, which can lead to arbitrary code execution with SYSTEM-level privileges. The vulnerability is classified under CWE-276 (Incorrect Default Permissions). The CVSS 4.0 vector indicates it requires local access with low attack complexity and user interaction, but results in high impact on confidentiality, integrity, availability, and security requirements. The vendor has provided a fix to affected customers.

Successful exploitation allows an attacker to execute arbitrary code with SYSTEM privileges on the affected server, potentially leading to full system compromise. The attack requires local access and user interaction to place a crafted file in the vulnerable directory. The medium CVSS score reflects the moderate risk due to these conditions and the significant impact of SYSTEM-level code execution.

A vulnerability fix is available and has been delivered to impacted customers by AIRBUS. It is recommended that all users of AIRBUS TETRA Connectivity Server version 7.0 apply the official patch or update provided by the vendor to remediate this issue. Since the vendor advisory confirms a fix is available, no additional mitigation steps are necessary beyond applying the patch.