CVE-2025-3002
Published: 31 March 2025
Summary
CVE-2025-3002 is a medium-severity Command Injection (CWE-77) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A critical OS command injection vulnerability has been identified in Digital China DCME-520 appliances up to version 20250320. The flaw resides in the file /usr/local/WWW/function/audit/newstatistics/mon_merge_stat_hist.php, where unsanitized input to the type_name parameter (and potentially other parameters) is passed to operating system commands. The issue is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 6.9.
An unauthenticated remote attacker can supply crafted values to the affected parameter and execute arbitrary operating system commands on the device. Because the attack requires no user interaction or credentials and can be launched over the network, successful exploitation grants the ability to run commands with the privileges of the web server process, potentially leading to further compromise of the appliance.
Public exploit code has already been published, and the EPSS score currently stands at 0.1201 with no material increase observed since disclosure. No vendor advisory or patch information is referenced in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8846
Vulnerability details
A vulnerability, which was classified as critical, has been found in Digital China DCME-520 up to 20250320. This issue affects some unknown processing of the file /usr/local/WWW/function/audit/newstatistics/mon_merge_stat_hist.php. The manipulation of the argument type_name leads to os command injection. The attack…
more
may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing web app (PHP endpoint) directly enables remote unauthenticated exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates user-supplied inputs like the type_name parameter to block OS command injection attempts.
Establishes processes to identify, report, and remediate flaws such as this critical command injection vulnerability through patching.
Enforces strict information input restrictions at web boundaries to limit manipulation of parameters like type_name that enable command injection.