PT-2025-39103 · Unknown · Vitogate 300

Adhkr · Published 2025-09-23 · Updated 2025-10-01 · CVE-2025-9494

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Vitogate 300 (affected versions not specified)

Description An OS command injection issue exists in the Vitogate 300. A malicious user can exploit this to compromise affected installations. The issue is present in the /cgi-bin/vitogate.cgi API endpoint when the form JSON parameter is set to form-0-2. The vulnerability occurs because input is not properly sanitized before being used in a format string passed to the popen() function at offset 0x21c24. This allows an authenticated attacker to inject arbitrary OS commands and achieve code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-9494

ZDI-25-925

Affected Products

Vitogate 300

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9494 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-925 · Security Note
• https://t.me/CVEtracker/33120 · Telegram Post
• https://twitter.com/CVEnew/status/1970393466711478687 · Twitter Post
• https://twitter.com/CveFindCom/status/1970301998898565133 · Twitter Post
• https://corporate.carrier.com/product-security/advisories-resources · Note