CVE-2025-64348
BaseFortify
Publication date: 2025-10-31
Last updated on: 2026-04-26
Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elog_project | elog | to 3.1.5-20251014 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in ELOG allows an authenticated user to modify or overwrite the configuration file, which can lead to denial of service. Additionally, if the execute facility is enabled with the "-x" command line flag, attackers could execute operating system commands on the host machine. By default, ELOG does not allow shell commands or self-registration, so exploitation depends on specific configurations.
How can this vulnerability impact me? :
The vulnerability can impact you by causing denial of service through modification or overwriting of configuration files. If the execute facility is enabled, it could allow attackers to execute arbitrary OS commands on the host machine, potentially leading to system compromise or further attacks.