CVE-2022-25411
Published: 28 February 2022
Summary
CVE-2022-25411 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Max-3000 Maxsite Cms. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Maxsite CMS version 180 contains a remote code execution vulnerability at the /admin/options endpoint. Tracked as CVE-2022-25411 and mapped to CWE-434, the flaw allows an attacker to upload a crafted PHP file that the application subsequently executes, producing a CVSS 3.1 score of 9.8 under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
An unauthenticated attacker with network access can exploit the issue directly by submitting the malicious file to the affected endpoint, resulting in arbitrary code execution on the server and full control over the confidentiality, integrity, and availability of the CMS instance.
The EPSS score has remained flat at 0.1069 with no material increase since disclosure. The only public reference is a GitHub issue that documents the flaw but supplies no additional mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-30081
Vulnerability details
A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.