CVE-2025-0509
Published: 04 February 2025
Summary
CVE-2025-0509 is a high-severity Files or Directories Accessible to External Parties (CWE-552) vulnerability in Netapp Hci Compute Node. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Compromise Software Supply Chain (T1195.002); ranked at the 21.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-14 (Signed Components) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates digital signature verification for software components prior to installation or execution, directly preventing the CVE's bypass of Sparkle's (Ed)DSA signing checks during updates.
Requires timely flaw remediation including updates to Sparkle version 2.6.4 or later, eliminating the specific vulnerability enabling signed update replacement.
Monitors software integrity using cryptographic mechanisms to detect unauthorized changes or tampered payloads substituted during the update process.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in Sparkle update framework directly enables tampering with signed updates (bypassing EdDSA verification) to deliver malicious payloads, facilitating supply chain compromise via software deployment tooling.
NVD Description
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
Deeper analysisAI
CVE-2025-0509 is a security vulnerability affecting Sparkle versions prior to 2.6.4, an open-source software update framework commonly used for macOS applications. The flaw enables an attacker to replace an existing signed update with a malicious payload, bypassing Sparkle's (Ed)DSA signing verification checks. Classified under CWE-552 (Files or Directories Accessible to External Parties), it carries a CVSS v3.1 base score of 7.3 (AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) and was published on 2025-02-04.
Exploitation requires an adjacent network position, high attack complexity, elevated privileges on the target system, and user interaction, such as a user approving a tampered update. A successful attack can result in high impacts to confidentiality, integrity, and availability across the affected component's scope, potentially allowing arbitrary code execution or full system compromise through the substituted payload.
Mitigation is achieved by updating to Sparkle version 2.6.4 or later. Key resources include the fixing pull request at https://github.com/sparkle-project/Sparkle/pull/2550, Sparkle's security and reliability documentation at https://sparkle-project.org/documentation/security-and-reliability/, and the NetApp advisory NTAP-20250124-0008 at https://security.netapp.com/advisory/ntap-20250124-0008/.
Details
- CWE(s)