CVE-2025-14253CWE-36

CVE-2025-14253

Medium · published December 8, 2025

CVSS v3.1
4.9
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traversal to download arbitrary system files.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00484 · 40.7th percentile
Weakness
CWE-36 · Absolute Path Traversal
Published
2025-12-08T13:15Z
Affected products (1)
ProductVersionsFixed in
gss/vitalsesp≤ 6.3—
References (2)
https://www.twcert.org.tw/en/cp-139-10543-380bd-2.html · [email protected]https://www.twcert.org.tw/tw/cp-132-10542-4c682-1.html · [email protected]
EPSS history
Timeline
  • 08 DEC 07:38Z
    Galaxy Software Services｜Vitals ESP - Arbitrary File Read
    cvelistv5