CVE-2025-9997
BaseFortify
Publication date: 2025-09-09
Last updated on: 2025-09-11
Assigner: Schneider Electric SE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| schneider_electric | saitel_dr | 11.06.29 |
| schneider_electric | saitel_dp | 11.06.33 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an OS Command Injection (CWE-78) in BLMon that occurs when commands executed in the operating system console during an SSH session are improperly neutralized. This means that an attacker could inject malicious commands that the system might execute, potentially leading to unauthorized actions on the system.
How can this vulnerability impact me? :
This vulnerability could allow an attacker with limited privileges during an SSH session to execute unauthorized commands on the operating system. This could lead to unauthorized access, data manipulation, or disruption of system operations, depending on the commands injected and executed.