Vulnerability · Published Jul 16, 2025 · Assigned by VulnCheck

CVE-2025-34300Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCE

Critical 10.0

In plain English

A critical-severity improper input validation in Lighthouse Studio from Sawtooth Software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 81.3% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.

Severity (CVSS 4.0)10.0Critical

Exploit odds (30 days)81.3%top 0.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling3Metasploit, Nuclei, Public PoC

Official description

A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. Exploitation allows an unauthenticated attacker can execute arbitrary commands.

Affected products (as reported)

Vendor	Product	Versions
Sawtooth Software	Lighthouse Studio	0 – before 9.16.14

Weakness: CWE-20, CWE-1336 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://sawtoothsoftware.com/resources/software-downloads/lighthouse-studio/version-history product, patch
https://slcyber.io/assetnote-security-research-center/rce-in-the-most-popular-survey-software-youve-never-heard-of/ technical-description
https://www.vulncheck.com/advisories/sawtooth-software-lighthouse-studio-preauthentication-rce third-party-advisory