CVE-2025-12556

High

Published: 06 November 2025

Published

06 November 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0008 24.1th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-12556 is a high-severity Argument Injection (CWE-88) vulnerability in Cisa (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation of Remote Services (T1210) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Flaw remediation directly mitigates the argument injection vulnerability by applying vendor patches or updates to eliminate the specific defect.

SI-10 Information Input Validation good match

prevent

Information input validation at entry points prevents attackers from injecting malicious arguments into commands, blocking arbitrary code execution.

SI-16 Memory Protection good match

prevent

Memory protection mechanisms like DEP and ASLR prevent unauthorized code execution even if arguments are injected successfully.

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Argument injection (CWE-88) enables remote low-privilege (PR:L) arbitrary code execution over network (AV:N), directly facilitating Exploitation of Remote Services (T1210) and Exploitation for Privilege Escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

An argument injection vulnerability exists in the affected product that could allow an attacker to execute arbitrary code within the context of the host machine.

Deeper analysisAI

CVE-2025-12556 is an argument injection vulnerability, classified under CWE-88, that exists in the affected product. It could allow an attacker to execute arbitrary code within the context of the host machine. The vulnerability was published on 2025-11-06T16:15:48.910 and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low complexity, and significant impacts on confidentiality, integrity, and availability.

An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L) and without requiring user interaction (UI:N). Successful exploitation enables arbitrary code execution in the context of the host machine, potentially leading to high-level compromise of confidentiality, integrity, and availability within the unchanged scope (S:U).

Further details on mitigation are available in the CISA ICS Advisory ICSA-25-308-05 at https://www.cisa.gov/news-events/ics-advisories/icsa-25-308-05.