Cyber Resilience

CVE-2025-14500

CriticalRCE

Published: 23 December 2025

Published
23 December 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0144 69.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14500 is a critical-severity OS Command Injection (CWE-78) vulnerability in Zerodayinitiative (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 30.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

This vulnerability is a command injection flaw, tracked as CVE-2025-14500 and originally ZDI-CAN-27394, that affects IceWarp14. It resides in the handling of the X-File-Operation header, where unsanitized user input is passed directly to a system call, enabling arbitrary command execution. The issue carries a CVSS 3.0 score of 9.8 and is classified under CWE-78.

Remote, unauthenticated attackers can exploit the flaw over the network to execute arbitrary code with SYSTEM-level privileges on affected IceWarp installations. No user interaction or credentials are required, making the attack surface broad for any exposed instance.

The associated Zero Day Initiative advisory ZDI-25-1072 provides further details on the issue. The EPSS probability rose from a low baseline to a peak of 0.0176 on 2026-04-24 before receding to its current value of 0.0071, indicating a period of increased exploitation interest after public disclosure.

EU & UK References

Vulnerability details

IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IceWarp. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the X-File-Operation…

more

header. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27394.

CWE(s)
CWE-78

Related Threats

CVEs Like This One

CVE-2025-20055Shared CWE-78
CVE-2026-0781Shared CWE-78
CVE-2026-7256Shared CWE-78
CVE-2025-10680Shared CWE-78
CVE-2026-0785Shared CWE-78
CVE-2026-45633Shared CWE-78
CVE-2021-47745Shared CWE-78
CVE-2026-34937Shared CWE-78
CVE-2026-34005Shared CWE-78
CVE-2026-28291Shared CWE-78

Affected Assets

Zerodayinitiative
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References