CVE-2025-0457

HIGH

NetVision Information airPASS 2.9.0-2.9.0.241231 and 3.0.0-3.0.0.241231 - Authenticated OS Command Injection

Title source: llm
STIX 2.1

Description

The airPASS from NetVision Information has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands.

References (2)

Core 2
Core References
Various Sources third-party-advisory
https://www.twcert.org.tw/tw/cp-132-8361-ff3fb-1.html
Various Sources third-party-advisory
https://www.twcert.org.tw/en/cp-139-8362-efb33-2.html

Scores

CVSS v3 8.8
EPSS 0.0092
EPSS Percentile 55.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (2)
NetVision Information/airPASS 2.9.0 - 2.9.0.241231
NetVision Information/airPASS 3.0.0 - 3.0.0.241231
Published Jan 16, 2025
Tracked Since Feb 18, 2026