CVE-2025-0396
Published: 12 January 2025
Summary
CVE-2025-0396 is a high-severity Injection (CWE-74) vulnerability in Winslow1984 (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked at the 44.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0396 is a critical command injection vulnerability affecting the shouldAcceptNewConnection function in the XPC Service component of exelban/stats up to version 2.11.21. The issue, associated with CWE-74 and CWE-77, allows manipulation that leads to arbitrary command execution and has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability on the affected host with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, enabling command injection that facilitates local privilege escalation.
Advisories recommend upgrading to exelban/stats version 2.11.22, which addresses the issue, as detailed in the GitHub release notes at https://github.com/exelban/stats/releases/tag/v2.11.22. Additional details are available from VulDB entries at https://vuldb.com/?ctiid.291269, https://vuldb.com/?id.291269, and https://vuldb.com/?submit.473229, as well as analysis at https://winslow1984.com/books/cve-collection/page/stats-v21122-local-privilege-escalation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1643
Vulnerability details
A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack…
more
on the local host. Upgrading to version 2.11.22 is able to address this issue. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in XPC service directly enables Unix shell command execution (T1059.004) and local privilege escalation via exploitation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires organizations to identify, report, and correct flaws like this command injection vulnerability by timely upgrading exelban/stats to version 2.11.22.
Mandates validation of untrusted inputs to components like the XPC Service's shouldAcceptNewConnection function to block command injection exploits.
Enforces least privilege to restrict the scope and impact of local privilege escalation resulting from successful command injection.