CVE-2025-24494

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-24494", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2025-02-05T15:36:40.967Z", "datePublished": "2025-03-05T15:15:19.986Z", "dateUpdated": "2025-03-05T16:09:05.368Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Ixia Vision Product Family", "vendor": "Keysight", "versions": [{"status": "affected", "version": "6.3.1"}]}], "credits": [{"lang": "en", "type": "finder", "value": "NATO Cyber Security Centre (NCSC) reported these vulnerabilities to Keysight."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Path traversal may allow remote code execution using privileged account \n(requires device admin account, cannot be performed by a regular user). \nIn combination with the 'Upload' functionality this could be used to \nexecute an arbitrary script or possibly an uploaded binary. Remediation \nin Version 6.7.0, release date: 20-Oct-24."}], "value": "Path traversal may allow remote code execution using privileged account \n(requires device admin account, cannot be performed by a regular user). \nIn combination with the 'Upload' functionality this could be used to \nexecute an arbitrary script or possibly an uploaded binary. Remediation \nin Version 6.7.0, release date: 20-Oct-24."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.6, "baseSeverity": "HIGH", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Path Traversal", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-03-05T15:15:19.986Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02"}, {"url": "https://www.keysight.com/us/en/contact.html"}, {"url": "https://support.ixiacom.com/"}, {"url": "https://support.ixiacom.com/support-overview/product-support/downloads-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Keysight recommends that all users <a target=\"_blank\" rel=\"nofollow\" href=\"https://support.ixiacom.com/support-overview/product-support/downloads-updates\">upgrade to the latest version of software as soon as possible.</a> \nRemediation \nin Version 6.7.0, release date: 20-Oct-24.&nbsp; Older versions of this software may have this vulnerability; Keysight \nrecommends that users discontinue the use of older software versions.\n<p>For more information about the Ixia Vision Product Family, please visit <a target=\"_blank\" rel=\"nofollow\" href=\"https://support.ixiacom.com/\">Ixia product support</a></p>Further questions can be answered by <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.keysight.com/us/en/contact.html\">contacting Keysight.</a>\n\n<br>"}], "value": "Keysight recommends that all users upgrade to the latest version of software as soon as possible. https://support.ixiacom.com/support-overview/product-support/downloads-updates \nRemediation \nin Version 6.7.0, release date: 20-Oct-24.\u00a0 Older versions of this software may have this vulnerability; Keysight \nrecommends that users discontinue the use of older software versions.\nFor more information about the Ixia Vision Product Family, please visit Ixia product support https://support.ixiacom.com/ \n\nFurther questions can be answered by contacting Keysight. https://www.keysight.com/us/en/contact.html"}], "source": {"advisory": "ICSA-25-063-02", "discovery": "EXTERNAL"}, "title": "Keysight Ixia Vision Product Family Path Traversal", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-05T16:08:56.354515Z", "id": "CVE-2025-24494", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-05T16:09:05.368Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-24494", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-05T16:08:56.354515Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-05T16:09:01.382Z"}}], "cna": {"title": "Keysight Ixia Vision Product Family Path Traversal", "source": {"advisory": "ICSA-25-063-02", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "NATO Cyber Security Centre (NCSC) reported these vulnerabilities to Keysight."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Keysight", "product": "Ixia Vision Product Family", "versions": [{"status": "affected", "version": "6.3.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Keysight recommends that all users upgrade to the latest version of software as soon as possible. https://support.ixiacom.com/support-overview/product-support/downloads-updates \nRemediation \nin Version 6.7.0, release date: 20-Oct-24.\u00a0 Older versions of this software may have this vulnerability; Keysight \nrecommends that users discontinue the use of older software versions.\nFor more information about the Ixia Vision Product Family, please visit Ixia product support https://support.ixiacom.com/ \n\nFurther questions can be answered by contacting Keysight. https://www.keysight.com/us/en/contact.html", "supportingMedia": [{"type": "text/html", "value": "Keysight recommends that all users <a target=\"_blank\" rel=\"nofollow\" href=\"https://support.ixiacom.com/support-overview/product-support/downloads-updates\">upgrade to the latest version of software as soon as possible.</a> \nRemediation \nin Version 6.7.0, release date: 20-Oct-24.&nbsp; Older versions of this software may have this vulnerability; Keysight \nrecommends that users discontinue the use of older software versions.\n<p>For more information about the Ixia Vision Product Family, please visit <a target=\"_blank\" rel=\"nofollow\" href=\"https://support.ixiacom.com/\">Ixia product support</a></p>Further questions can be answered by <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.keysight.com/us/en/contact.html\">contacting Keysight.</a>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02"}, {"url": "https://www.keysight.com/us/en/contact.html"}, {"url": "https://support.ixiacom.com/"}, {"url": "https://support.ixiacom.com/support-overview/product-support/downloads-updates"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Path traversal may allow remote code execution using privileged account \n(requires device admin account, cannot be performed by a regular user). \nIn combination with the 'Upload' functionality this could be used to \nexecute an arbitrary script or possibly an uploaded binary. Remediation \nin Version 6.7.0, release date: 20-Oct-24.", "supportingMedia": [{"type": "text/html", "value": "Path traversal may allow remote code execution using privileged account \n(requires device admin account, cannot be performed by a regular user). \nIn combination with the 'Upload' functionality this could be used to \nexecute an arbitrary script or possibly an uploaded binary. Remediation \nin Version 6.7.0, release date: 20-Oct-24.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Path Traversal"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-03-05T15:15:19.986Z"}}}, "cveMetadata": {"cveId": "CVE-2025-24494", "state": "PUBLISHED", "dateUpdated": "2025-03-05T16:09:05.368Z", "dateReserved": "2025-02-05T15:36:40.967Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2025-03-05T15:15:19.986Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ixia Vision Product Family", "vendor": "Keysight", "versions": [{"status": "affected", "version": "6.3.1"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Path traversal may allow remote code execution using privileged account \n(requires device admin account, cannot be performed by a regular user). \nIn combination with the 'Upload' functionality this could be used to \nexecute an arbitrary script or possibly an uploaded binary. Remediation \nin Version 6.7.0, release date: 20-Oct-24."}, {"lang": "es", "value": "El path traversal puede permitir la ejecuci\u00f3n remota de c\u00f3digo mediante una cuenta privilegiada (requiere una cuenta de administrador del dispositivo, no puede ser realizada por un usuario normal). En combinaci\u00f3n con la funci\u00f3n \"Upload\", esto podr\u00eda usarse para ejecutar un script arbitrario o posiblemente un binario cargado. Soluci\u00f3n en la versi\u00f3n 6.7.0, fecha de lanzamiento: 20 de octubre de 2024."}], "id": "CVE-2025-24494", "lastModified": "2026-06-17T08:59:07.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-24494", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-03-05T16:08:56.354515Z", "version": "2.0.3"}}]}, "published": "2025-03-05T16:15:38.937", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://support.ixiacom.com/"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://support.ixiacom.com/support-overview/product-support/downloads-updates"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.keysight.com/us/en/contact.html"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{}