PT-2025-46182 · Comodo+1 · Itop+1

Published 2025-04-23 · Updated 2026-02-24 · CVE-2025-47286

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 2.7.13 Combodo iTop versions prior to 3.2.2

Description Combodo iTop is a web-based IT service management tool. An administrator can execute code on the server by editing the configuration of the iTop instance in affected versions. Versions 2.7.13 and 3.2.2 include measures to escape and check the configuration parameter before executing a command based on it.

Recommendations Update to version 2.7.13 or later. Update to version 3.2.2 or later.

Exploit

Fix

Special Elements Injection

OS Command Injection

Weakness Enumeration

CWE-74

CWE-78

Related Identifiers

BDU:2025-06926

CVE-2025-47286

GHSA-4W93-RW6G-5M9C

Affected Products

Red Os

Itop

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47286.json · Exploit
• https://github.com/Combodo/iTop/security/advisories/GHSA-4w93-rw6g-5m9c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47286 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06926 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-47286 · Security Note
• https://github.com/Combodo/iTop/releases/tag/3.2.2 · Note
• https://twitter.com/CVEnew/status/1987961909656908251 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-php-itop-cve-2025-47286-8.0 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-php-itop-cve-2025-47286-7.3 · Note