PT-2025-51115 · Tiny Rdm · Tiny Rdm

Zznq · CVE-2025-14606 · Published 2025-12-13 · Updated 2025-12-13

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions tiny-rdm versions through 1.2.5

Description A security issue exists in tiny-rdm related to deserialization. The pickle.loads function within the pickle convert.go file is affected. This can be triggered remotely and requires a high level of complexity to exploit, though exploitation appears difficult. The details of the issue have been publicly disclosed. The project maintainers were notified but have not yet responded.

Recommendations versions prior to 1.2.6

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-20

CWE-502

Related Identifiers

CVE-2025-14606

Affected Products

Tiny Rdm

References · 9

• 🔥 https://github.com/tiny-craft/tiny-rdm/issues/512 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14606.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-14606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14606 · Security Note
• https://vuldb.com/?submit.704138 · Note
• https://vuldb.com/?id.336282 · Note
• https://twitter.com/CVEnew/status/1999865310363738343 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1999980036426768647 · Twitter Post
• https://vuldb.com/?ctiid.336282 · Note