CVE-2025-20055

CriticalRCE

Published: 14 January 2025

Published

14 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0182 83.3th percentile

Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-20055 is a critical-severity OS Command Injection (CWE-78) vulnerability in Jvn (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-20055 is an OS command injection vulnerability, tracked under CWE-78, that affects the STEALTHONE D220 and D340 network storage servers from Y'S corporation. The flaw permits unauthenticated remote attackers to inject and execute arbitrary operating-system commands on the device, reflected in its CVSS 3.1 base score of 9.8 resulting from network attack vector, low complexity, and no required privileges or user interaction.

An attacker with network reachability to an unpatched device can issue specially crafted requests that result in full compromise of confidentiality, integrity Availability on the affected storage server, enabling outcomes such as data exfiltration, configuration changes, or deployment of persistent malware.

Firmware updates addressing the issue are referenced in vendor and JVN advisories, specifically versions v6-03-03 for the D220/D340 series and v7-00-11 for the related D440 model. The EPSS score rose from a low baseline to a recorded peak of 0.0384, indicating that exploitation interest increased after public disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-2145

Vulnerability details

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may execute an arbitrary OS command.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

Remote unauthenticated OS command injection in a network-accessible storage appliance directly enables T1190 (Exploit Public-Facing Application) and arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1