CVE-2025-13447

Katalog CVE

CVSS 6.8 · Medium EPSS 27,2%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada progress connection manager for objectscale*, progress ecs connection manager +3 lainnya. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters

Rincian

Terbit di NVD

13 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

27,2% peluang dieksploitasi; lebih tinggi dari 98,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabilities-CVE-2025-13444-CVE... advisory vendor
• https://community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 advisory vendor
• https://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 advisory vendor
• https://community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 advisory vendor