CVE-2025-1265

CriticalRCE

Published: 20 February 2025

Published

20 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0043 62.3th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1265 is a critical-severity OS Command Injection (CWE-78) vulnerability in Elseta (inferred from references). Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 37.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly prevents OS command injection by validating and sanitizing inputs to the Vinci Protocol Analyzer, blocking malicious command payloads.

SI-2 Flaw Remediation good match

prevent

Remediates the specific command injection flaw through timely patching as recommended in the CISA ICSA-25-051-06 advisory.

AC-6 Least Privilege partial match

prevent

Limits damage from privilege escalation by enforcing least privilege, restricting the scope of arbitrary code execution post-injection.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

OS command injection (CWE-78) with network access and low privileges directly enables remote exploitation of public-facing apps (T1190), arbitrary command execution via interpreters (T1059), and privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An OS command injection vulnerability exists in Vinci Protocol Analyzer that could allow an attacker to escalate privileges and perform code execution on affected system.

Deeper analysisAI

CVE-2025-1265 is an OS command injection vulnerability (CWE-78) in the Vinci Protocol Analyzer, published on 2025-02-20. The flaw carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating critical severity with network accessibility, low attack complexity, and requirements for only low privileges. It affects the Vinci Protocol Analyzer software, enabling attackers to escalate privileges and execute arbitrary code on the impacted system.

An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) without requiring user interaction (UI:N). Successful exploitation allows command injection, leading to privilege escalation and arbitrary code execution with high impacts on confidentiality, integrity, and availability (C/I/A:H), further amplified by a change in scope (S:C).

For mitigation details, refer to the CISA ICS Advisory ICSA-25-051-06 at https://www.cisa.gov/news-events/ics-advisories/icsa-25-051-06 and the vendor support page at https://elseta.com/support/.