CVE-2025-1338

Medium

Published: 16 February 2025

Published

16 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0911 92.8th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1338 is a medium-severity Injection (CWE-74) vulnerability in Baidu (inferred from references). Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

A vulnerability has been identified in NUUO Camera versions up to 20250203, specifically in the print_file function within /handle_config.php. The issue stems from improper handling of the log argument, enabling command injection as classified under CWE-74 and CWE-77. It carries a CVSS 4.0 score of 6.9 and can be triggered remotely without authentication or user interaction.

An unauthenticated remote attacker can supply crafted input to the affected parameter and execute arbitrary commands on the target system. Public exploit code has been released, and the vendor was notified prior to disclosure but provided no response or fix.

The associated EPSS score rose from lower values to a peak of 0.2134 on 2026-05-06 before receding to the current 0.0911, indicating increased exploitation interest following public release of the details. No official patches or mitigation guidance appear in the referenced disclosures.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-2109

Vulnerability details

A vulnerability was found in NUUO Camera up to 20250203. It has been declared as critical. This vulnerability affects the function print_file of the file /handle_config.php. The manipulation of the argument log leads to command injection. The attack can be…

initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s): CWE-74 CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Direct remote unauthenticated command injection in a public-facing web application (/handle_config.php) enables initial access via exploitation of the exposed service.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1