PT-2025-4147 · Ud-Lt2 · Ud-Lt2

Kaori Takashima + 2 · Published 2025-01-22 · Updated 2025-02-20 · CVE-2025-20617

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UD-LT2 firmware versions 1.00.008 SE and earlier

Description An issue exists due to the improper neutralization of special elements used in an OS command, allowing for the execution of arbitrary OS commands by an attacker with administrative access. This can be exploited by an attacker who can access the affected product with an administrative account.

Recommendations For versions 1.00.008 SE and earlier, update to a version later than 1.00.008 SE to resolve the issue. As a temporary workaround, consider restricting administrative access to the affected product until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-20617

Affected Products

Ud-Lt2

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-20617 · Security Note
• https://jvn.jp/en/jp/JVN15293958 · Note
• https://twitter.com/VulmonFeeds/status/1882066851263389950 · Twitter Post
• https://t.me/cvedetector/18516 · Telegram Post
• https://twitter.com/CVEnew/status/1881949697239122112 · Twitter Post
• https://t.me/cvenotify/108182 · Telegram Post
• https://iodata.jp/support/information/2025/01_ud-lt2 · Note
• https://t.me/cvenotify/111859 · Telegram Post
• https://t.me/cvenotify/111858 · Telegram Post
• https://t.me/cvedetector/16074 · Telegram Post