CVE-2025-3578
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-3578 is a critical-severity Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism (CWE-1039) vulnerability in Incibe (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the LLM/Generative AI Risks risk domain; MITRE ATLAS techniques in scope: Physical Countermeasures (AML.T0008.003), Evade AI Model (AML.T0015), Adversarial AI Attacks (AML.T0017.000).
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10934
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability Data
A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, list credentials of users in production or development environments. In addition, it would be possible to…
more
cause bugs that would result in the exfiltration of sensitive information, such as details about the software or internal system paths. These actions could be carried out through the misuse of LLM Prompt (chatbot) technology, via the /api/<string-chat>/message endpoint, by manipulating the contents of the ‘content’ parameter.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- AI-specific weaknesses CR
- CWE-1427 — Prompt injection via untrusted content param to LLM chatbot endpoint.
Mapped by Cyber Resilience · not in NVD. Poisoning and extraction cases are routed to MITRE ATLAS instead of a synthetic CWE.- Classification Reason
- Matched keywords: llm
Related Threats
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing can specifically exercise the recognition mechanism against adversarial examples to surface the weakness.
Input validation can reject or sanitize perturbed inputs before they reach the recognition mechanism.
System monitoring can observe anomalous classifications or input patterns indicative of adversarial perturbations.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Monitoring runtime data and inputs directly supports detection of adversarial perturbations to recognition mechanisms.
Secure SDLC practices include robustness testing and adversarial-input handling during model development.
Recording this class of ML vulnerability is a prerequisite for subsequent mitigation.
Explicit identification of adversarial ML threats informs the need to address this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can explicitly cover adversarial input testing for recognition mechanisms.
Threat intelligence can surface adversarial ML attack patterns but does not implement technical controls.
Secure development lifecycle requires adversarial testing and robustness validation for ML-based recognition components.
Application security requirements can mandate detection and handling of adversarial perturbations in automated recognition systems.
Secure architecture principles include resilience against input manipulation and adversarial ML attacks.
Secure coding practices can incorporate input sanitization and adversarial robustness checks for ML models.