PT-2025-33502 · Msoft · Msoft Mflash

Marsel Shagiev · Published 2025-08-15 · Updated 2025-08-16 · CVE-2025-9060

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MSoft MFlash version 8.0

Description: A vulnerability has been found in MSoft MFlash that allows execution of arbitrary code on the server. The issue occurs in the integration configuration functionality, which is only available to administrators. The vulnerability is related to insufficient validation of parameters when setting up security components.

Recommendations: Apply MSoft MFlash 8.2-653 hotfix 11.06.2025 and above.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-9060

Affected Products

Msoft Mflash

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9060 · Security Note
• https://github.com/klsecservices/Advisories/blob/master/K-MSoft-2025-002.md · Note
• https://twitter.com/offseq/status/1956528988865671227 · Twitter Post
• https://twitter.com/CVEnew/status/1956654815037259944 · Twitter Post
• https://t.me/CVEtracker/30150 · Telegram Post
• https://twitter.com/fernandokarl/status/1956436221015589099 · Twitter Post