CVE-2025-14213CWE-20CWE-78

Cato's Socket WebUI is vulnerable to OS Command Injection

High · published March 31, 2026

CVSS v4.0
8.3
EPSS
1%
Percentile
61.8
In the wild
Unconfirmed
What it is

Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface (UI) to execute arbitrary operating system commands as the root user on the Socket’s internal system.

The record
Technical detail
CVSS v4.0
8.3 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:H
EPSS
0.00976 · 61.8th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-31T11:35Z
EPSS history
Timeline
  • 31 MAR 11:35Z
    Cato's Socket WebUI is vulnerable to OS Command Injection
    cvelistv5