PT-2025-13795 · Digital China · Dcme-520

Fizzl · Published 2025-03-31 · Updated 2025-04-01 · CVE-2025-3002

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Digital China DCME-520 up to 20250320

Description A critical issue has been found in the processing of the file /usr/local/WWW/function/audit/newstatistics/mon merge stat hist.php. The manipulation of the type name argument leads to os command injection. This issue can be exploited remotely.

Recommendations For Digital China DCME-520 up to 20250320, as a temporary workaround, consider restricting access to the file /usr/local/WWW/function/audit/newstatistics/mon merge stat hist.php to minimize the risk of exploitation. Avoid using the type name argument in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2025-3002

Affected Products

Dcme-520

References · 9

• 🔥 https://github.com/Fizz-L/CVE1/blob/main/DCME-520%20Remote%20command%20execution.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-3002 · Security Note
• https://twitter.com/CVEnew/status/1906752632389247440 · Twitter Post
• https://t.me/cvedetector/21613 · Telegram Post
• https://vuldb.com/?ctiid.302051 · Note
• https://vuldb.com/?id.302051 · Note
• https://twitter.com/VulmonFeeds/status/1906867903971958885 · Twitter Post
• https://t.me/cvetracker/20365 · Telegram Post
• https://vuldb.com/?submit.524225 · Note