CVE-2025-1546
Published: 21 February 2025
Summary
CVE-2025-1546 is a medium-severity Command Injection (CWE-77) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A vulnerability classified as critical has been identified in the BDCOM Behavior Management and Auditing System up to version 20250210. It resides in the log_operate_clear function within the file /webui/modules/log/operate.mds, where improper handling of the start_code argument enables OS command injection. The issue is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 6.9.
The flaw can be exploited remotely by unauthenticated attackers who supply crafted input to the affected parameter, resulting in arbitrary command execution on the underlying operating system. Public exploit code has been released, and the vendor was notified prior to disclosure but provided no response.
The associated references consist of vulnerability database entries and a public proof-of-concept repository; none describe vendor patches or specific mitigation steps. The EPSS score rose from a low baseline to a peak of 0.0214 on 2025-12-18 before receding to its current value of 0.0080, indicating increased exploitation interest after the initial disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4495
Vulnerability details
A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical. Affected by this vulnerability is the function log_operate_clear of the file /webui/modules/log/operate.mds. The manipulation of the argument start_code leads to os…
more
command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote OS command injection in a network-accessible web endpoint enables unauthenticated exploitation of a public-facing application (T1190) and arbitrary command execution via the system's command interpreter (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents OS command injection by requiring validation of the vulnerable start_code input parameter in the log_operate_clear function.
SI-2 mandates timely identification, reporting, and correction of the specific software flaw enabling command injection in this CVE.
SC-7 mitigates remote exploitation by monitoring and controlling network access to the vulnerable /webui/modules/log/operate.mds endpoint.