BaseFortify

Publication date: 2025-10-31

Last updated on: 2026-04-26

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

ELOG allows an authenticated user to modify or overwrite the configuration file, resulting in denial of service. If the execute facility is specifically enabled with the "-x" command line flag, attackers could execute OS commands on the host machine. By default, ELOG is not configured to allow shell commands or self-registration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-31

Last Modified

2026-04-26

Generated

2026-07-06

AI Q&A

2025-11-01

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64348

Affected Vendors & Products

Vendor	Product	Version / Range
elog_project	elog	to 3.1.5-20251014 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in ELOG allows an authenticated user to modify or overwrite the configuration file, which can lead to denial of service. Additionally, if the execute facility is enabled with the "-x" command line flag, attackers could execute operating system commands on the host machine. By default, ELOG does not allow shell commands or self-registration, so exploitation depends on specific configurations.

Impact Analysis

The vulnerability can impact you by causing denial of service through modification or overwriting of configuration files. If the execute facility is enabled, it could allow attackers to execute arbitrary OS commands on the host machine, potentially leading to system compromise or further attacks.

Hi! I’m here to help you understand CVE-2025-64348. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70