Cyber Resilience

CVE-2018-25159

CriticalPublic PoC

Published: 11 March 2026

Published
11 March 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0039 31.1th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2018-25159 is a critical-severity Unauthorized Error Injection Can Degrade Hardware Redundancy (CWE-1334) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2018-25159 is an object-graph navigation language (OGNL) injection vulnerability in the Epross AVCON6 systems management platform. It enables unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions into crafted requests targeting the login.action endpoint, specifically via the redirect parameter. This allows instantiation of ProcessBuilder objects to run system commands with root privileges. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-1334.

Unauthenticated remote attackers can exploit the vulnerability with low complexity and no user interaction required. By sending HTTP requests containing OGNL payloads in the redirect parameter to login.action, they achieve remote code execution, gaining full control over the system including high confidentiality, integrity, and availability impacts through root-level command execution.

Advisories and related resources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/epross-avcon6-ognl-remote-code-execution-via-login-action and a proof-of-concept exploit at https://www.exploit-db.com/exploits/47379, provide further technical details on the vulnerability. No specific patches or mitigations are detailed in the provided information.

EU & UK References

Vulnerability details

Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the…

more

redirect parameter to instantiate ProcessBuilder objects and execute system commands with root privileges.

CWE(s)
CWE-1334

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is an unauthenticated OGNL injection in a public-facing web login endpoint (login.action), enabling remote code execution via crafted HTTP requests, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents OGNL injection by requiring validation of untrusted inputs like the redirect parameter in login.action to block malicious expressions.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of the specific OGNL injection flaw through patching, eliminating the root cause of unauthenticated RCE.

SC-7 Boundary Protection partial match
prevent

Boundary protection at web interfaces can deploy web application firewalls to inspect and block crafted HTTP requests containing OGNL payloads.

References