Cyber Resilience

CVE-2025-48047

CriticalRCE

Published: 29 May 2025

Published
29 May 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0162 82.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-48047 is a critical-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 9.4 (Critical).

Operationally, ranked in the top 17.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

An authenticated user can exploit a command injection vulnerability (CWE-78) in the NetFax Server product by supplying unsanitized input to the ping functionality exposed at the /test.php endpoint. The flaw affects the Mici NetFax Server and carries a CVSS 4.0 score of 9.4, reflecting network attack vector, low attack complexity, and high impact across confidentiality, integrity, and availability.

An attacker with valid credentials can leverage the injection to execute arbitrary operating-system commands on the server, potentially leading to full compromise of the affected system and any connected resources.

The referenced Rapid7 advisory states that the identified vulnerabilities in the Mici NetFax Server product remain unfixed, indicating that no official patch or mitigation guidance has been released by the vendor as of publication.

EPSS for this CVE remains low and unchanged at a peak of 0.0162, with no reported real-world exploitation activity.

EU & UK References

Vulnerability details

An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References