6.5

CVE-2025-25504

Exploit
An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connect to the device over TCP port 4444 without authentication and execute arbitrary commands with root privileges.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Niceforyou ≫ Gefen Webfwc Version1.70v
   Niceforyou ≫ Gefen Gf-avip-mc Firmware Versiona5.22
Niceforyou ≫ Gefen Webfwc Version1.85h
   Niceforyou ≫ Gefen Gf-avip-mc Firmware Versiona5.310
Niceforyou ≫ Gefen Webfwc Version1.86v
   Niceforyou ≫ Gefen Gf-avip-mc Firmware Versiona5.310
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.68% 0.713
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.