PT-2025-26590 · Materialise · Materialise Orthoview

Joe Dillon · Published 2025-06-23 · Updated 2026-01-28 · CVE-2025-23049

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Meridian Technique Materialise OrthoView versions through 7.5.1

Description Meridian Technique Materialise OrthoView through version 7.5.1 is susceptible to an OS Command Injection when servlet sharing is enabled. This allows for potential remote code execution and authentication bypass. The issue occurs when the application improperly handles user-supplied input, allowing attackers to inject arbitrary commands that are then executed by the operating system. The vulnerable component is related to servlet sharing functionality.

Recommendations Versions prior to 7.5.1 should be updated. Disable servlet sharing functionality to mitigate the risk.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-23049

Affected Products

Materialise Orthoview

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-23049 · Security Note
• https://t.me/defcon_news/132133 · Telegram Post
• https://t.me/RNetsec/22049 · Telegram Post
• https://twitter.com/CrowdCyber_Com/status/1974602306852155726 · Twitter Post
• https://twitter.com/_r_netsec/status/1973141578224116012 · Twitter Post
• https://outurnate.com/remote-code-execution-and-authentication-bypass-in-materialise-orthoview-cve-2025-23049 · Note
• https://twitter.com/CveFindCom/status/1937113673366909237 · Twitter Post
• https://twitter.com/reverseame/status/2016493505258860720 · Twitter Post
• https://t.me/latest_high_impact_cve/2781 · Telegram Post
• https://materialise.com/en/healthcare/orthoview · Note
• https://materialise.com/en/healthcare/orthoview/security-vulnerability · Note
• https://twitter.com/CVEnew/status/1937114035557687317 · Twitter Post
• https://t.me/cvetracker/26827 · Telegram Post