Cyber Resilience

CVE-2025-3578

Published
15 April 2025
Modified
15 April 2026
CVSS Score v4 9.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0047 38th percentile
Risk Priority 46 floored blend · peak EPSS

Summary

CVE-2025-3578 is a critical-severity Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism (CWE-1039) vulnerability in Incibe (inferred from references). Its CVSS base score is 9.3 (Critical).

Operationally, ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as LLM Application Platforms; in the LLM/Generative AI Risks risk domain; MITRE ATLAS techniques in scope: Physical Countermeasures (AML.T0008.003), Evade AI Model (AML.T0015), Adversarial AI Attacks (AML.T0017.000).

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, list credentials of users in production or development environments. In addition, it would be possible to…

more

cause bugs that would result in the exfiltration of sensitive information, such as details about the software or internal system paths. These actions could be carried out through the misuse of LLM Prompt (chatbot) technology, via the /api/<string-chat>/message endpoint, by manipulating the contents of the ‘content’ parameter.

CWE(s)

AI Security AnalysisAI

AI Category
LLM Application Platforms
Risk Domain
LLM/Generative AI Risks
OWASP Top 10 for LLMs 2025
None mapped
AI-specific weaknesses CR
  • CWE-1427 — Prompt injection via untrusted content param to LLM chatbot endpoint.
Mapped by Cyber Resilience · not in NVD. Poisoning and extraction cases are routed to MITRE ATLAS instead of a synthetic CWE.
Classification Reason
Matched keywords: llm

Related Threats

MITRE ATLAS TechniquesAI

MITRE ATLAS techniques

AML.T0008.003: Physical CountermeasuresAML.T0015: Evade AI ModelAML.T0017.000: Adversarial AI AttacksAML.T0031: Erode AI Model IntegrityAML.T0043: Craft Adversarial DataAML.T0043.000: White-Box Optimization

CVEs Like This One

CVE-2025-26644Shared CWE-1039
CVE-2023-20071Shared CWE-1039

Affected Assets

Incibe
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing can specifically exercise the recognition mechanism against adversarial examples to surface the weakness.

Input validation can reject or sanitize perturbed inputs before they reach the recognition mechanism.

System monitoring can observe anomalous classifications or input patterns indicative of adversarial perturbations.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.CM-09 mostly match
prevents

Monitoring runtime data and inputs directly supports detection of adversarial perturbations to recognition mechanisms.

PR.PS-06 mostly match
prevents

Secure SDLC practices include robustness testing and adversarial-input handling during model development.

ID.RA-01 partial match
prevents

Recording this class of ML vulnerability is a prerequisite for subsequent mitigation.

ID.RA-03 partial match
prevents

Explicit identification of adversarial ML threats informs the need to address this weakness.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development can explicitly cover adversarial input testing for recognition mechanisms.

mitigates

Threat intelligence can surface adversarial ML attack patterns but does not implement technical controls.

prevents

Secure development lifecycle requires adversarial testing and robustness validation for ML-based recognition components.

prevents

Application security requirements can mandate detection and handling of adversarial perturbations in automated recognition systems.

prevents

Secure architecture principles include resilience against input manipulation and adversarial ML attacks.

prevents

Secure coding practices can incorporate input sanitization and adversarial robustness checks for ML models.

References