Cyber Resilience

CVE-2025-52385

CriticalRCE

Published: 13 August 2025

Published
13 August 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0248 85.6th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-52385 is a critical-severity Code Injection (CWE-94) vulnerability in Mitre (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-52385 affects Studio 3T versions 2025.1.0 and earlier. The flaw is an instance of CWE-94 that permits remote code execution when a crafted payload is supplied to the child_process module, producing a CVSS 3.1 base score of 9.8.

A remote attacker with no authentication or user interaction required can send the malicious payload over the network and obtain arbitrary code execution on the target system, resulting in full compromise of confidentiality, integrity, and availability.

Public references consist of CWE definitions together with a proof-of-concept repository and the upstream RoboMongo project page; none of the listed sources describe patches or mitigation steps.

EPSS remains flat at 0.0248 with no material increase after disclosure.

EU & UK References

Vulnerability details

An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child_process module

CWE(s)
CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct remote code execution via crafted payload on publicly accessible application (CWE-94 code injection, no auth required).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-13773Shared CWE-94
CVE-2025-50692Shared CWE-94
CVE-2026-30643Shared CWE-94
CVE-2026-30460Shared CWE-94
CVE-2025-71243Shared CWE-94
CVE-2026-44262Shared CWE-94
CVE-2024-13792Shared CWE-94
CVE-2020-37052Shared CWE-94
CVE-2026-42555Shared CWE-94
CVE-2025-65037Shared CWE-94

Affected Assets

Mitre
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and correction of flaws like the code injection vulnerability in Studio 3T's child_process module to prevent remote arbitrary code execution.

SI-10 Information Input Validation good match
prevent

Enforces information input validation at system interfaces to block crafted payloads that enable code injection via the child_process module.

SI-3 Malicious Code Protection partial match
preventdetect

Deploys malicious code protection mechanisms at entry points to detect and prevent arbitrary code execution from injected payloads.

References