CVE-2025-6225CWE-78command-injection
CVE-2025-6225
published January 7, 2026
What it is
Kieback&Peter Neutrino-GLT product is used for building management. It's web component "SM70 PHWEB" is vulnerable to shell command injection via login form. The injected commands would execute with low privileges. The vulnerability has been fixed in version 9.40.02
The record
Technical detail
- CVSS
- 6.9 · NONE
- CVSS v4.0
- Not supplied
- EPSS
- 0.01084 · 64.9th percentile
- Weakness
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Published
- 2026-01-07T19:15Z
References (1)
EPSS history
Timeline