CVE-2025-1265

CriticalRCE

Published: 20 February 2025

Published

20 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0043 62.7th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1265 is a critical-severity OS Command Injection (CWE-78) vulnerability in Elseta (inferred from references). Its CVSS base score is 9.4 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 37.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-1265 is an OS command injection vulnerability (CWE-78) in the Vinci Protocol Analyzer, published on 2025-02-20. The flaw carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating critical severity with network accessibility, low attack complexity, and requirements for only low privileges. It affects the Vinci Protocol Analyzer software, enabling attackers to escalate privileges and execute arbitrary code on the impacted system.

An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) without requiring user interaction (UI:N). Successful exploitation allows command injection, leading to privilege escalation and arbitrary code execution with high impacts on confidentiality, integrity, and availability (C/I/A:H), further amplified by a change in scope (S:C).

For mitigation details, refer to the CISA ICS Advisory ICSA-25-051-06 at https://www.cisa.gov/news-events/ics-advisories/icsa-25-051-06 and the vendor support page at https://elseta.com/support/.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-4564

Vulnerability details

An OS command injection vulnerability exists in Vinci Protocol Analyzer that could allow an attacker to escalate privileges and perform code execution on affected system.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

OS command injection (CWE-78) with network access and low privileges directly enables remote exploitation of public-facing apps (T1190), arbitrary command execution via interpreters (T1059), and privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1