CVE-2025-29902CWE-94

Remote code execution that allows unauthorized users to execute arbitrary code on the server machine

Critical · published June 13, 2025

CVSS v3.1
10.0
EPSS
1%
Percentile
66.8
In the wild
Unconfirmed
What it is

🚨 One tiny flaw lets unauthorized users run code on your server! It's like giving anyone a backstage pass at a concert without checking their ID. 🔥 Imagine a restaurant where anyone can walk into the kitchen and cook whatever they want, including dangerous dishes. This vulnerability allows attackers to do just that, executing any code they choose on your server without any verification. The consequences of this vulnerability are absolutely devastating! An attacker could gain full control of your server, allowing them to steal sensitive data, deploy malware, or even take your entire system offline. The potential for chaos is immense, and immediate action is required!

Put simply

Imagine a restaurant where anyone can walk into the kitchen and cook whatever they want, including dangerous dishes. This vulnerability allows attackers to do just that, executing any code they choose on your server without any verification. This critical remote code execution (RCE) vulnerability occurs because the server fails to properly authenticate users before executing arbitrary code. Unauthorized access means attackers can send malicious commands directly to the server, compromising its integrity.

What to do

The consequences of this vulnerability are absolutely devastating! An attacker could gain full control of your server, allowing them to steal sensitive data, deploy malware, or even take your entire system offline. The potential for chaos is immense, and immediate action is required! Patch this vulnerability immediately by updating to the latest version provided by the vendor. Ensure that proper authentication controls are in place, and conduct a security audit to assess whether any unauthorized code has already been executed. Don’t delay—act now! You've got this! By following these steps, you can secure your server and reclaim your peace of mind. 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01156 · 66.8th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-06-13T09:23Z
EPSS history
Timeline
  • 13 JUN 09:23Z
    Remote code execution that allows unauthorized users to execute arbitrary code on the server machine
    cvelistv5