Cyber Resilience

CVE-2025-1845

Medium

Published: 03 March 2025

Published
03 March 2025
Modified
28 May 2025
KEV Added
Patch
CVSS Score v4 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0077 74.0th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1845 is a medium-severity Injection (CWE-74) vulnerability in Esafenet Dsm. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

A command injection vulnerability exists in ESAFENET DSM version 3.1.2 within the examExportPDF function of the file /admin/plan/examExportPDF. The flaw is triggered by unsanitized input to the argument s and is tracked under CWE-74 and CWE-77. It received a CVSS 4.0 score of 5.3 and can be reached over the network.

An authenticated attacker with low privileges can supply a crafted s parameter to the endpoint and execute arbitrary operating-system commands on the server. The attack requires no user interaction and has been publicly disclosed with a working proof-of-concept.

No vendor patch or official advisory has been issued; the vendor was notified but did not respond. Public references consist of a GitHub report and Vuldb entries that document the issue and exploit details. The associated EPSS score remains low, moving only from 0.0077 to a peak of 0.0121.

EU & UK References

Vulnerability details

A vulnerability has been found in ESAFENET DSM 3.1.2 and classified as critical. Affected by this vulnerability is the function examExportPDF of the file /admin/plan/examExportPDF. The manipulation of the argument s leads to command injection. The attack can be launched…

more

remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Why these techniques?

Command injection in public-facing web function directly enables remote exploitation (T1190) and arbitrary command execution via system interpreter (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-1840Same vendor: Esafenet
CVE-2025-0789Same vendor: Esafenet
CVE-2025-1844Same vendor: Esafenet
CVE-2025-0792Same vendor: Esafenet
CVE-2025-0791Same vendor: Esafenet
CVE-2025-0786Same vendor: Esafenet
CVE-2025-2927Same vendor: Esafenet
CVE-2025-1841Same vendor: Esafenet
CVE-2025-0793Same vendor: Esafenet
CVE-2025-0788Same vendor: Esafenet

Affected Assets

esafenet
dsm
3.1.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly validates and sanitizes the 's' argument in the examExportPDF function to prevent command injection exploitation.

prevent

Requires identification, reporting, and remediation of the command injection flaw in ESAFENET DSM 3.1.2 to eliminate the vulnerability.

prevent

Restricts the type, size, and quantity of the 's' argument inputs to block malicious command injection payloads.

References