PT-2025-29823 · Hyperledger · Sawtooth Lighthouse Studio

Adam Kues · Publicado 2025-04-09 · Atualizado 2025-09-15 · CVE-2025-34300

Positive Technologies (AI Summary)

CVSS v4.0

10

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Sawtooth Lighthouse Studio versions prior to 9.16.14

Description A template injection vulnerability exists in the Perl web application ciwweb.pl within Sawtooth Lighthouse Studio, allowing unauthenticated attackers to execute arbitrary commands. Approximately 480 services are potentially affected worldwide.

Recommendations Update Sawtooth Lighthouse Studio to version 9.16.14 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-1336

Identificadores relacionados

BDU:2025-09256

CVE-2025-34300

Produtos afetados

Sawtooth Lighthouse Studio

Referências · 17

• 🔥 https://slcyber.io/assetnote-security-research-center/rce-in-the-most-popular-survey-software-youve-never-heard-of · Exploit
• https://twitter.com/infosec_au/status/1945419077301702821 · Publicação no Twitter
• https://twitter.com/the_yellow_fall/status/1946033848120385906 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1945482458155385187 · Publicação no Twitter
• https://twitter.com/Komodosec/status/1959632578979475674 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-34300 · Nota de Segurança
• https://twitter.com/PaxionCyber/status/1947291597068001658 · Publicação no Twitter
• https://t.me/cvenotify/129158 · Publicação no Telegram
• https://twitter.com/fridaysecurity/status/1946004354831356043 · Publicação no Twitter
• https://t.me/CSIRT_italia/2724 · Publicação no Telegram
• https://sawtoothsoftware.com/resources/software-downloads/lighthouse-studio · Correção
• https://bdu.fstec.ru/vul/2025-09256 · Nota de Segurança
• https://t.me/pentestingnews/64723 · Publicação no Telegram
• https://twitter.com/threatintel/status/1953121654520881523 · Publicação no Twitter
• https://twitter.com/assetnote/status/1945419328922251284 · Publicação no Twitter