CVE-2025-10203
BaseFortify
Publication date: 2025-09-15
Last updated on: 2025-09-16
Assigner: National Instruments
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| digilent | waveforms | 3.24.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-23 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a relative path traversal flaw in Digilent WaveForms software (version 3.24.3 and earlier) caused by improper input validation. An attacker can create a specially crafted .DWF3WORK file that, when opened by a user, allows arbitrary code execution on the affected system. Exploitation requires the user to open the malicious file. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to arbitrary code execution, which means an attacker could run malicious code on your system. This can compromise the confidentiality, integrity, and availability of your data and system, potentially leading to data loss, unauthorized access, or system disruption. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for the presence or opening of specially crafted .DWF3WORK files, as exploitation requires user interaction with such files. You can search for .DWF3WORK files on your system using commands like 'find / -name "*.DWF3WORK"' on Unix/Linux systems or 'dir /s *.DWF3WORK' on Windows. Additionally, monitoring user activity or logs for attempts to open these files may help detect exploitation attempts. There are no specific detection commands provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Digilent WaveForms to version 3.24.4 or later, as this version addresses the vulnerability. Additionally, avoid opening .DWF3WORK files from untrusted or unknown sources to prevent exploitation. [1]