CVE-2025-48047
Published: 29 May 2025
Summary
CVE-2025-48047 is a critical-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 9.4 (Critical).
Operationally, ranked in the top 17.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
An authenticated user can exploit a command injection vulnerability (CWE-78) in the NetFax Server product by supplying unsanitized input to the ping functionality exposed at the /test.php endpoint. The flaw affects the Mici NetFax Server and carries a CVSS 4.0 score of 9.4, reflecting network attack vector, low attack complexity, and high impact across confidentiality, integrity, and availability.
An attacker with valid credentials can leverage the injection to execute arbitrary operating-system commands on the server, potentially leading to full compromise of the affected system and any connected resources.
The referenced Rapid7 advisory states that the identified vulnerabilities in the Mici NetFax Server product remain unfixed, indicating that no official patch or mitigation guidance has been released by the vendor as of publication.
EPSS for this CVE remains low and unchanged at a peak of 0.0162, with no reported real-world exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16371
Vulnerability details
An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.