PT-2025-40609 · Unknown · Win-Cli-Mcp-Server

Published 2025-10-03 · Updated 2025-11-03 · CVE-2025-11202

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions win-cli-mcp-server (affected versions not specified)

Description This issue allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server. Authentication is not required to exploit this issue. The flaw resides within the resolveCommandPath method due to insufficient validation of user-supplied input before it is used in a system call. An attacker can leverage this to execute code with the privileges of the service account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-11202

ZDI-25-930

Affected Products

Win-Cli-Mcp-Server

References · 12

• https://github.com/simon-ami/win-cli-mcp-server/commit/521b4a34190d03bde7d433d213c36357181a6d09 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-930 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11202 · Security Note
• https://reddit.com/r/CVEWatch/comments/1on8u60/top_10_trending_cves_03112025 · Reddit Post
• https://twitter.com/SystemTek_UK/status/1974538315899482619 · Twitter Post
• https://t.me/cveNotify/140894 · Telegram Post
• https://t.me/CVEtracker/36110 · Telegram Post
• https://twitter.com/CveFindCom/status/1983634953389609123 · Twitter Post
• https://twitter.com/0dayPublishing/status/1983623499324301803 · Twitter Post
• https://twitter.com/TheZDIBugs/status/1975218365741273379 · Twitter Post
• https://twitter.com/CVEnew/status/1983622504808640964 · Twitter Post