PT-2025-33886 · Unknown · Neurobin Shc

S0L42 · Published 2025-08-19 · Updated 2025-09-12 · CVE-2025-9176

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: neurobin shc versions through 4.0.3

Description: A security flaw has been discovered in neurobin shc up to version 4.0.3. The make function within the src/shc.c file of the Environment Variable Handler component is affected. Manipulation of this function results in operating system command injection. The attack is only possible with local access. The exploit has been released publicly and may be exploited.

Recommendations: For versions through 4.0.3, consider disabling or restricting the use of the make function within the Environment Variable Handler component as a temporary workaround until a patch is available.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2025-9176

Affected Products

Neurobin Shc

References · 11

• 🔥 https://magnificent-dill-351.notion.site/Command-Execution-of-env-in-shc-4-0-3-249c693918ed80c997f4e9420f945d01 · Exploit
• https://osv.dev/vulnerability/CVE-2025-9176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9176 · Security Note
• https://twitter.com/CVEnew/status/1957972522357416399 · Twitter Post
• https://vuldb.com/?id.320557 · Note
• https://vuldb.com/?submit.630744 · Note
• https://t.me/cveNotify/135240 · Telegram Post
• https://vuldb.com/?ctiid.320557 · Note
• https://t.me/CVEtracker/30419 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1957987237309620302 · Twitter Post
• https://t.me/cveNotify/132848 · Telegram Post