rxerium/CVE-2025-7775

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Nuclei template README describing a detection method for CVE-2025-7775. It explains how to extract the date from a remote NetScaler instance and compare it to the patch date to determine vulnerability. No exploit code is present; the artifact only provides instructions for running a detection script.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists solely of a README.md file describing a Nuclei template for detecting CVE-2025-7775. No executable code, scripts, or configuration files are present in the reviewed text. The README contains only documentation, usage instructions, references, and contact information, with no concealed or deceptive behavior.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesMarkdown
Target softwareNetScaler ADCNetScaler Gateway
Attack typesCWE-119
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The README describes a detection method that checks the patch date of a remote instance, which is a non-intrusive vulnerability check. It does not contain any code that exercises or exploits the vulnerability. The artifact is classified as a scanner because its primary operation is to detect or report exposure.

README.md:5-7

Requirements

  • Requires Nuclei to be downloaded and installed.README.md:11
  • Requires the Nuclei template file to be copied locally.README.md:12

Observed behavior

  • Extracts the date from the remote instance and compares it to the date patches were made available.README.md:7
  • Runs a Nuclei command against a target host to perform the detection.README.md:13
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Documentation Only
README.mdThe only file provided in the evidence is a documentation file with no executable content.README.md:1-45
Review boundaries

What the analysis did not establish

  • Only the README.md file is included; the actual Nuclei template (template.yaml) and any other files are omitted, so the exact detection logic cannot be verified.
  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are present.
  • Only README.md was included as selected text; two other files (total 1987 bytes) were omitted and classified as unclassified, but their metadata indicates no executable source was identified. The review cannot assess the content of those omitted files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1