PT-2025-1294 · Unknown · Stealthone D220+2

Chuya Hayakawa + 1 · Publicado 2025-01-06 · Atualizado 2025-01-14 · CVE-2025-20016

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions STEALTHONE D220/D340/D440 (affected versions not specified)

Description A user with administrative privileges who logs in to the web management page of the affected product may execute an arbitrary OS command. The vulnerability is related to the lack of measures to neutralize special elements used in the OS command. This could allow a remote attacker to execute arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2025-00766

CVE-2025-20016

Produtos afetados

Stealthone D220

Stealthone D340

Stealthone D440

Referências · 9

• https://t.me/cvenotify/107288 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-20016 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-00766 · Nota de Segurança
• https://t.me/cvedetector/15241 · Publicação no Telegram
• https://jvn.jp/en/vu/JVNVU99653331 · Nota
• https://stealthone.net/product_info/d220-d340%e3%80%8cv6-03-03%e3%80%8d%e5%8f%8a%e3%81%b3d440%e3%80%8cv7-00-11%e3%80%8d%e3%83%95%e3%82%a1%e3%83%bc%e3%83%a0%e3%82%a6%e3%82%a7%e3%82%a2%e3%82%92%e3%83%aa%e3%83%aa%e3%83%bc%e3%82%b9%e8%87%b4 · Nota
• https://twitter.com/VulmonFeeds/status/1879164885273096691 · Publicação no Twitter
• https://twitter.com/WolfgangSesin/status/1879117982871269645 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1879103734950822012 · Publicação no Twitter