CVE-2025-7097
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-07-06

Last updated on: 2025-07-18

Assigner: VulDB

Description
A vulnerability, which was classified as critical, has been found in Comodo Internet Security Premium 12.3.4.8162. This issue affects some unknown processing of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation of the argument binary/params leads to os command injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-07-06
Last Modified
2025-07-18
Generated
2026-05-07
AI Q&A
2025-07-07
EPSS Evaluated
2026-05-05
NVD
CVE-2025-7097
EUVD
EUVD-2025-20157
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
comodo internet_security 12.3.4.8162
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a critical security flaw in Comodo Internet Security Premium version 12.3.4.8162. It involves the component called Manifest File Handler processing a file named cis_update_x64.xml. Specifically, manipulation of the argument binary/params can lead to OS command injection, meaning an attacker could execute arbitrary operating system commands. The attack can be initiated remotely but is considered difficult to exploit due to its high complexity.


How can this vulnerability impact me? :

If exploited, this vulnerability could allow an attacker to execute arbitrary operating system commands on your system remotely. This could lead to unauthorized control over your system, potentially compromising confidentiality, integrity, and availability of your data and services.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart