PT-2025-1294 · Unknown · Stealthone D220+2

Chuya Hayakawa + 1 · Published 2025-01-06 · Updated 2025-01-14 · CVE-2025-20016

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions STEALTHONE D220/D340/D440 (affected versions not specified)

Description A user with administrative privileges who logs in to the web management page of the affected product may execute an arbitrary OS command. The vulnerability is related to the lack of measures to neutralize special elements used in the OS command. This could allow a remote attacker to execute arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-00766

CVE-2025-20016

Affected Products

Stealthone D220

Stealthone D340

Stealthone D440

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-20016 · Security Note
• https://bdu.fstec.ru/vul/2025-00766 · Security Note
• https://t.me/cvenotify/107288 · Telegram Post
• https://t.me/cvedetector/15241 · Telegram Post
• https://jvn.jp/en/vu/JVNVU99653331 · Note
• https://stealthone.net/product_info/d220-d340%e3%80%8cv6-03-03%e3%80%8d%e5%8f%8a%e3%81%b3d440%e3%80%8cv7-00-11%e3%80%8d%e3%83%95%e3%82%a1%e3%83%bc%e3%83%a0%e3%82%a6%e3%82%a7%e3%82%a2%e3%82%92%e3%83%aa%e3%83%aa%e3%83%bc%e3%82%b9%e8%87%b4 · Note
• https://twitter.com/VulmonFeeds/status/1879164885273096691 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1879117982871269645 · Twitter Post
• https://twitter.com/CVEnew/status/1879103734950822012 · Twitter Post