CVE-2025-58384 (CVSS 10): Critical RCE Flaw Found in Watchdoc Print Management Software

Doxense has issued an urgent security advisory addressing a critical remote code execution (RCE) vulnerability in its Watchdoc print management solution, tracked as CVE-2025-58384 with a CVSS score of 10. The advisory warns that Watchdoc versions lower than 6.1.1 allow arbitrary remote code execution in an unauthenticated and remote manner via an unauthenticated API call.

In practical terms, an attacker can execute arbitrary code on a vulnerable Watchdoc print server without credentials, effectively taking control of the environment. According to Doxense, code execution on the print server at minimum allows compromising all printers (confidentiality breach) and retrieving the Active Directory account used by the print server, enabling deeper movement within enterprise networks.

The advisory recommends immediate remediation, including restricting remote access to port 5744 and upgrading to Watchdoc 6.1.1, with further guidance to review firewall settings so that only ports 5754 and 5753 are externally accessible or properly configured for remote IIS server use.