CVE-2025-41674CWE-78

Remote Command Injection in diagnostic Action Due to Improper Input Neutralization

High · published July 21, 2025

CVSS v3.1
7.2
EPSS
1%
Percentile
52.7
In the wild
Unconfirmed
What it is

A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00702 · 52.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-07-21T09:29Z
EPSS history
Timeline
  • 21 JUL 09:29Z
    Remote Command Injection in diagnostic Action Due to Improper Input Neutralization
    cvelistv5