CVE-2025-9494

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-9494", "assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f", "state": "PUBLISHED", "assignerShortName": "Carrier", "dateReserved": "2025-08-26T17:40:54.110Z", "datePublished": "2025-09-23T01:12:17.459Z", "dateUpdated": "2025-09-23T13:34:06.974Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Vitogate 300", "vendor": "Viessmann", "versions": [{"lessThan": "3.1.0.0", "status": "affected", "version": "1", "versionType": "SKU"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "adhkr of LuwakLab working with Trend Micro Zero Day Initiative"}], "datePublic": "2025-09-22T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices.<br>"}], "value": "An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 8.5, "baseSeverity": "HIGH", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f", "shortName": "Carrier", "dateUpdated": "2025-09-23T01:12:17.459Z"}, "references": [{"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>These\nvulnerabilities have been fixed with Vitogate 300 software version 3.1.0.1. </p>\n\n<p>Customers\nare strongly encouraged to upgrade by downloading software version 3.1.0.1 at the&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://connectivity.viessmann-climatesolutions.com/gb/mp-fp/vitogate/vitogate-300-bn-mb.html\">Vitogate\n300&nbsp;</a>website.<b></b></p>"}], "value": "These\nvulnerabilities have been fixed with Vitogate 300 software version 3.1.0.1. \n\n\n\nCustomers\nare strongly encouraged to upgrade by downloading software version 3.1.0.1 at the\u00a0Vitogate\n300\u00a0website."}], "source": {"discovery": "EXTERNAL"}, "title": "Viessmann Vitogate 300 OS Command Injection", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-23T13:33:59.911370Z", "id": "CVE-2025-9494", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T13:34:06.974Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9494", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-23T13:33:59.911370Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T13:34:04.246Z"}}], "cna": {"title": "Viessmann Vitogate 300 OS Command Injection", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "adhkr of LuwakLab working with Trend Micro Zero Day Initiative"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Viessmann", "product": "Vitogate 300", "versions": [{"status": "affected", "version": "1", "lessThan": "3.1.0.0", "versionType": "SKU"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "These\nvulnerabilities have been fixed with Vitogate 300 software version 3.1.0.1. \n\n\n\nCustomers\nare strongly encouraged to upgrade by downloading software version 3.1.0.1 at the\u00a0Vitogate\n300\u00a0website.", "supportingMedia": [{"type": "text/html", "value": "<p>These\nvulnerabilities have been fixed with Vitogate 300 software version 3.1.0.1. </p>\n\n<p>Customers\nare strongly encouraged to upgrade by downloading software version 3.1.0.1 at the&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://connectivity.viessmann-climatesolutions.com/gb/mp-fp/vitogate/vitogate-300-bn-mb.html\">Vitogate\n300&nbsp;</a>website.<b></b></p>", "base64": false}]}], "datePublic": "2025-09-22T16:00:00.000Z", "references": [{"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices.", "supportingMedia": [{"type": "text/html", "value": "An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f", "shortName": "Carrier", "dateUpdated": "2025-09-23T01:12:17.459Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9494", "state": "PUBLISHED", "dateUpdated": "2025-09-23T13:34:06.974Z", "dateReserved": "2025-08-26T17:40:54.110Z", "assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f", "datePublished": "2025-09-23T01:12:17.459Z", "assignerShortName": "Carrier"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Vitogate 300", "vendor": "Viessmann", "versions": [{"lessThan": "3.1.0.0", "status": "affected", "version": "1", "versionType": "SKU"}]}], "source": "productsecurity@carrier.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo (OS) ha sido descubierta en el Vitogate 300, que puede ser explotada por usuarios maliciosos para comprometer las instalaciones afectadas. Espec\u00edficamente, el endpoint '/cgi-bin/vitogate.cgi' se ve afectado cuando el par\u00e1metro JSON 'form' se establece en 'form-0-2'. La vulnerabilidad se deriva del hecho de que esa funci\u00f3n en el offset 0x21c24 no sanitiza adecuadamente la entrada proporcionada antes de interpolarla en una cadena de formato que se pasa a 'popen()'. En consecuencia, un atacante autenticado es capaz de inyectar comandos del sistema operativo (OS) arbitrarios y as\u00ed obtener ejecuci\u00f3n de c\u00f3digo en los dispositivos afectados."}], "id": "CVE-2025-9494", "lastModified": "2026-10-11T20:10:00.200", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "productsecurity@carrier.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9494", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-23T13:33:59.911370Z", "version": "2.0.3"}}]}, "published": "2025-09-23T02:15:47.410", "references": [{"source": "productsecurity@carrier.com", "url": "https://www.corporate.carrier.com/product-security/advisories-resources/"}], "sourceIdentifier": "productsecurity@carrier.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "productsecurity@carrier.com", "type": "Secondary"}]}

{}

{"created": "2025-09-23T16:03:25.890571+00:00", "updated": "2025-09-23T16:03:25.890649+00:00", "vendors": ["viessmann", "viessmann$PRODUCT$vitogate_300"]}