Vulnerability · Published Jan 16, 2025 · Assigned by twcert
CVE-2025-0457NetVision Information airPASS - OS Command Injection
High 8.8
In plain English
A high-severity OS command injection in airPASS from NetVision Information. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 37.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The airPASS from NetVision Information has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NetVision Information | airPASS | 2.9.0 – before 2.9.0.2412313.0.0 – before 3.0.0.241231 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-8361-ff3fb-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-8362-efb33-2.html third-party-advisory