CVE-2025-28357

High

Published: 01 October 2025

Published

01 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0017 37.6th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-28357 is a high-severity CRLF Injection (CWE-93) vulnerability in Neto CMS (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

SI-2 requires timely identification, reporting, and correction of system flaws, directly mitigating this CVE by patching the CRLF injection vulnerability in affected Neto CMS versions.

SI-10 Information Input Validation good match

prevent

SI-10 enforces validation of information inputs, preventing CRLF injection by rejecting crafted HTTP requests with invalid characters or payloads.

SC-7 Boundary Protection good match

preventdetect

SC-7 provides boundary protection with monitoring and control of external communications, blocking or detecting malicious HTTP requests exploiting the CRLF vulnerability via web application firewalls or proxies.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CRLF injection in public-facing Neto CMS enables unauthenticated remote arbitrary code execution via crafted HTTP request, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supplying a crafted HTTP request.

Deeper analysisAI

CVE-2025-28357, published on 2025-10-01, is a CRLF injection vulnerability (CWE-93) in Neto CMS versions v6.313.0 through v6.314.0. The flaw allows attackers to execute arbitrary code by supplying a crafted HTTP request. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation with significant impacts.

Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity, though it requires user interaction, such as tricking a user into processing a malicious request. Successful exploitation enables arbitrary code execution, compromising confidentiality, integrity, and availability on the affected Neto CMS instance.

Mitigation details and further advisories are available from the vendor at http://neto.com and in the report at https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-28357.md.