CVE-2025-9588
BaseFortify
Publication date: 2025-09-23
Last updated on: 2025-10-02
Assigner: Computer Emergency Response Team of the Republic of Turkey
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ironmountain | envision | to 250563 (exc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an OS Command Injection in Iron Mountain Archiving Services Inc. EnVision before version 250563. It occurs due to improper neutralization of special elements used in OS commands, allowing an attacker to inject and execute arbitrary commands on the affected system.
How can this vulnerability impact me? :
This vulnerability can have a severe impact as it allows remote attackers to execute arbitrary commands with high privileges on the affected system. This can lead to complete system compromise, including unauthorized access, data theft, data modification, and denial of service.