2 lines
3.7 KiB
JSON
2 lines
3.7 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"MB-Secure","vendor":"Honeywell","versions":[{"lessThan":"V12.53","status":"affected","version":"V11.04","versionType":"semver"}]}],"source":"psirt@honeywell.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:honeywell:mb-secure_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"9A3948BD-0AA0-4F44-87DE-6F93FE58A3CC","versionEndExcluding":"12.53","versionStartIncluding":"11.04","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:honeywell:mb-secure:-:*:*:*:*:*:*:*","matchCriteriaId":"068F05DB-54F1-4F6B-8A1B-501E7841469B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:honeywell:mb-secure_pro_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"D6782306-FD38-4001-9F99-9B1A9EC820F9","versionEndExcluding":"03.09","versionStartIncluding":"01.06","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:honeywell:mb-secure_pro:-:*:*:*:*:*:*:*","matchCriteriaId":"F8F28351-A605-4F24-B62B-408D77C661E7","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most recent version of this product."},{"lang":"es","value":"La vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando del sistema operativo ('Inyección de comandos del sistema operativo') en Honeywell MB-Secure permite el abuso de privilegios. Este problema afecta a MB-Secure desde la versión 11.04 hasta la 12.53 y a MB-Secure PRO desde la versión 01.06 hasta la 03.09. Honeywell también recomienda actualizar a la versión más reciente de este producto."}],"id":"CVE-2025-2605","lastModified":"2026-06-17T09:07:16.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@honeywell.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-2605","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-05-02T13:32:21.228869Z","version":"2.0.3"}}]},"published":"2025-05-02T13:15:46.440","references":[{"source":"psirt@honeywell.com","tags":["Vendor Advisory"],"url":"https://www.honeywell.com/us/en/product-security#security-notices"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://seclists.org/fulldisclosure/2025/May/19"}],"sourceIdentifier":"psirt@honeywell.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@honeywell.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-78"}],"source":"nvd@nist.gov","type":"Primary"}]}
|