CVE-2025-9976CWE-78command-injection

CVE-2025-9976

Critical · published October 13, 2025

CVSS v3.1
9.0
EPSS
1%
Percentile
59.4
In the wild
Unconfirmed
What it is

🚨 An OS Command Injection vulnerability in the Station Launcher App could allow an attacker to execute any code on your machine—imagine giving a stranger the keys to your computer! 🔥 Think of it like a restaurant where anyone can walk into the back kitchen and start cooking without any oversight. If they know what they're doing, they could serve the most questionable dishes directly to your table! With this vulnerability, an attacker could run rogue commands on your machine, potentially leading to data theft, system compromise, or even a full-scale takeover of your computer. The damage could be absolutely devastating if left unaddressed!

Put simply

Think of it like a restaurant where anyone can walk into the back kitchen and start cooking without any oversight. If they know what they're doing, they could serve the most questionable dishes directly to your table! This OS Command Injection allows attackers to execute arbitrary commands by exploiting the Station Launcher App's failure to properly validate input. This leads to a situation where any user input can trigger unintended code execution.

What to do

With this vulnerability, an attacker could run rogue commands on your machine, potentially leading to data theft, system compromise, or even a full-scale takeover of your computer. The damage could be absolutely devastating if left unaddressed! To protect yourself, update the Station Launcher App to the latest version immediately. Ensure that your security settings are configured to reject untrusted commands and regularly audit your systems for any irregularities. Don't wait, secure your environment today! You've got this! Implement these steps and you'll be one step closer to securing your system! 🛡️

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00902 · 59.4th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-10-13T12:15Z
References (1)
EPSS history
Timeline
  • 13 OCT 07:33Z
    OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x
    cvelistv5