CVE-2025-65074

HIGH

WaveStore Video Management Software Server < 6.42.4 - OS Command Execution via Path Traversal

Title source: llm
STIX 2.1

Description

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to execute arbitrary OS commands on the server using path traversal in the showerr script. This issue was fixed in version 6.44.44

References (2)

Core 2
Core References
Third Party Advisory third-party-advisory
https://cert.pl/en/posts/2025/12/CVE-2025-65074

Scores

CVSS v3 7.2
EPSS 0.0042
EPSS Percentile 33.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-22 CWE-78
Status published
Products (1)
wavestore/video_management_software_server < 6.42.4
Published Dec 16, 2025
Tracked Since Feb 18, 2026