CVE-2025-14307
Robocode 1.9.3.6
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:RedSummary
CVE-2025-14307 is a critical-severity Insecure Temporary File (CWE-377) vulnerability in Robocode Robocode. Its CVSS base score is 9.3 (Critical).
Operationally, ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201885
Vulnerability Data
An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This…
more
vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces file-system access authorizations so that temporary files cannot be read or modified by unauthorized processes.
AC-6 reduces the privileges available to processes that create or access temporary files, limiting blast radius if a file is predictable or left readable.
SC-4 directly stops unauthorized information leakage through shared resources such as world-writable temporary directories.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require avoiding insecure temp-file creation patterns.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect insecure temporary files but does not prevent their creation.
Secure development life cycle mandates secure handling of temporary files during design and coding.
Application security requirements can specify secure temporary-file creation and access controls.
Secure system architecture principles discourage insecure temporary-file patterns but do not directly address them.
Secure coding standards explicitly require safe temporary-file APIs and permissions.
Information deletion policies may cover secure removal of temporary files after use.