Cyber Resilience

CVE-2025-22469

Medium

Published: 06 August 2025

Published
06 August 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0126 79.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22469 is a medium-severity OS Command Injection (CWE-78) vulnerability in Jvn (inferred from references). Its CVSS base score is 6.9 (Medium).

Operationally, ranked in the top 20.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2025-22469 is an OS command injection vulnerability, tracked under CWE-78, that affects SATO CL4/6NX Plus and CL4/6NX-J Plus printers running firmware versions prior to 1.15.5-r1. The flaw permits execution of arbitrary operating-system commands on the device when invoked with a certain non-administrative user privilege.

An unauthenticated network attacker can supply crafted input that results in command execution, granting limited control over the printer’s operating system without requiring administrative credentials. Successful exploitation can lead to disclosure or modification of local data and disruption of printer availability.

Vendor advisories from SATO and JVN recommend immediate upgrade to firmware version 1.15.5-r1 or later; the updates address the command-injection vector and are available through the manufacturer’s support portal.

EPSS scores for the CVE rose from a low baseline to a recorded peak of 0.0223, indicating increased exploitation interest after public disclosure.

EU & UK References

Vulnerability details

OS command injection vulnerability exists in CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1. An arbitrary OS command may be executed on the system with a certain non-administrative user privilege.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Jvn
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References