CVE-2025-65076

MEDIUM

WaveStore Video Management Software Server < 6.42.4 - Authenticated Path Traversal via ilog Script

Title source: llm
STIX 2.1

Description

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to read or delete any file on the server using path traversal in the ilog script. This script is being run with root privileges. This issue was fixed in version 6.44.44

References (2)

Core 2
Core References
Third Party Advisory third-party-advisory
https://cert.pl/en/posts/2025/12/CVE-2025-65074

Scores

CVSS v3 6.1
EPSS 0.0029
EPSS Percentile 20.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-22
Status published
Products (1)
wavestore/video_management_software_server < 6.42.4
Published Dec 16, 2025
Tracked Since Feb 18, 2026