CVE-2025-3022
Published: 31 March 2025
Summary
CVE-2025-3022 is a critical-severity OS Command Injection (CWE-78) vulnerability in Incibe (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 20.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Os command injection vulnerability CVE-2025-3022 affects e-solutions e-management and is tracked under CWE-78. The flaw resides in the /data/apache/e-management/api/api3.php endpoint, where the client parameter is processed without adequate sanitization, enabling operating-system command execution on the underlying server.
An unauthenticated attacker with network access can supply a crafted client value to run arbitrary commands, resulting in full control over the affected host with impacts to confidentiality, integrity, and availability. The CVSS 4.0 score of 9.3 reflects the absence of required privileges or user interaction and the network-attack vector.
The referenced INCIBE advisory addresses multiple vulnerabilities in the same product family and is the primary source of vendor guidance for affected deployments. The associated EPSS score remains low, moving only from 0.0125 to a peak of 0.0164.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8732
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability details
Os command injection vulnerability in e-solutions e-management. This vulnerability allows an attacker to execute arbitrary commands on the server via the ‘client’ parameter in the /data/apache/e-management/api/api3.php endpoint.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.