CVE-2025-12509CWE-829

CVE-2025-12509

High · published October 31, 2025

CVSS v3.1
8.4
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

⚡ A crafted Global_Shipping script can give anyone with admin access a direct line to execute commands on the BRAIN2 server! 🚀 Think of it like a VIP ticket to a concert that gives you backstage access — a script created by a trusted user can access all the behind-the-scenes areas, potentially leading to chaos if misused. If an attacker exploits this vulnerability, they could run any command on the server with admin privileges, which means they could manipulate data, alter configurations, or even shut down operations. The consequences could be absolutely devastating for your organization's integrity and trust.

Put simply

Think of it like a VIP ticket to a concert that gives you backstage access — a script created by a trusted user can access all the behind-the-scenes areas, potentially leading to chaos if misused. This vulnerability in the Global_Shipping script allows admin users to execute arbitrary commands on the BRAIN2 server, effectively bypassing security protocols that should prevent unauthorized command execution.

What to do

If an attacker exploits this vulnerability, they could run any command on the server with admin privileges, which means they could manipulate data, alter configurations, or even shut down operations. The consequences could be absolutely devastating for your organization's integrity and trust. To fix this, ensure that you audit admin permissions carefully and patch the Global_Shipping script to prevent unauthorized command execution. Consider implementing stricter script validation and execution controls. You've got this! With a few strategic updates, you'll fortify your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00292 · 20.7th percentile
Weakness
CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2025-10-31T20:15Z
References (1)
EPSS history
Timeline
  • 31 OCT 15:51Z
    Scripts for the module Global_Shipping executable on BRAIN2 Server
    cvelistv5