PT-2025-19981 · Hashicorp · Terraform Windns Provider

Polo-Sec · Published 2025-05-06 · Updated 2025-05-20 · CVE-2025-46735

Positive Technologies (AI Summary)

CVSS v4.0

1.1

Low

Base vector

AV:L/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:U

Name of the Vulnerable Software and Affected Versions Terraform WinDNS Provider versions prior to 1.0.5

Description A security issue has been found in the Terraform WinDNS Provider, where the windns record resource did not sanitize the input variables, leading to authenticated command injection in the underlying PowerShell command prompt.

Recommendations For versions prior to 1.0.5, update to version 1.0.5 to resolve the issue. As a temporary workaround, consider sanitizing the input variables for the windns record resource to prevent command injection.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-46735

GHSA-4VGF-2CM4-MP7C

GO-2025-3670

OPENSUSE-SU-2025:15135-1

Affected Products

Terraform Windns Provider

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46735.json · Exploit
• https://osv.dev/vulnerability/GO-2025-3670 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15135-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-46735 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46735 · Security Note
• https://osv.dev/vulnerability/GHSA-4vgf-2cm4-mp7c · Vendor Advisory
• https://github.com/nrkno/terraform-provider-windns/security/advisories/GHSA-4vgf-2cm4-mp7c · Note
• https://github.com/nrkno/terraform-provider-windns/commit/c76f69610c1b502f90aaed8c4f102194530b5bce · Note
• https://github.com/nrkno/terraform-provider-windns · Note
• https://t.me/cvedetector/24623 · Telegram Post
• https://suse.com/security/cve/CVE-2025-46721 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/QOPKRPL75SZMLT3YSQAZEDWH7RBRXGJK · Note
• https://suse.com/security/cve/CVE-2025-4658 · Note
• https://t.me/cvetracker/23196 · Telegram Post
• https://suse.com/security/cve/CVE-2025-46815 · Note