PT-2025-4862 · Ud-Lt2 · Ud-Lt2

Kaori Takashima + 2 · Published 2025-01-22 · Updated 2025-01-22 · CVE-2025-23237

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UD-LT2 firmware versions 1.00.008 SE and earlier

Description An issue exists due to the improper neutralization of special elements used in an OS command, allowing for the execution of arbitrary OS commands if a user logs in to the CLI of the affected product.

Recommendations For versions 1.00.008 SE and earlier, update to a version that addresses the OS Command Injection issue. As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-23237

Affected Products

Ud-Lt2

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-23237 · Security Note
• https://twitter.com/VulmonFeeds/status/1882061730999640567 · Twitter Post
• https://jvn.jp/en/jp/JVN15293958 · Note
• https://t.me/cvenotify/108184 · Telegram Post
• https://twitter.com/CVEnew/status/1881949695615897887 · Twitter Post
• https://t.me/cvedetector/16076 · Telegram Post
• https://iodata.jp/support/information/2025/01_ud-lt2 · Note