CVE-2025-13284

CriticalRCE

Published: 17 November 2025

Published

17 November 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0053 67.5th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13284 is a critical-severity OS Command Injection (CWE-78) vulnerability in Org (inferred from references). Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-13284 is an OS command injection vulnerability (CWE-78) in ThinPLUS software developed by ThinPLUS. Published on 2025-11-17, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high impact on confidentiality, integrity, and availability. The flaw allows unauthenticated remote attackers to inject and execute arbitrary operating system commands on the affected server.

Unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables full remote code execution on the server, potentially granting attackers complete control over the system, including data exfiltration, modification, or disruption of services.

Advisories from the Taiwan CERT Coordination Center (TWCERT/CC) detail the vulnerability at https://www.twcert.org.tw/en/cp-139-10513-0d82b-2.html and https://www.twcert.org.tw/tw/cp-132-10512-e196b-1.html, providing guidance for practitioners on identification and response.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-197757

Vulnerability details

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

CVE enables unauthenticated remote exploitation of a public-facing application (T1190) via OS command injection, directly facilitating arbitrary command execution through command interpreters (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0