CVE-2025-60803
Published: 24 October 2025
Summary
CVE-2025-60803 is a critical-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-60803 is an unauthenticated remote code execution (RCE) vulnerability in Antabot White-Jotter up to commit 9bcadc. The issue stems from the component /api/aaa;/../register and is classified under CWE-78 (OS Command Injection). It received a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and lack of prerequisites.
Any unauthenticated attacker with network access to the vulnerable instance can exploit this flaw without user interaction. Successful exploitation enables arbitrary code execution on the server, potentially compromising confidentiality, integrity, and availability with high impact.
Mitigation details and further information are available in the GitHub issue at https://github.com/Antabot/White-Jotter/issues/162.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35863
Vulnerability details
Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the component /api/aaa;/../register.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote code execution vulnerability in a public-facing web application API endpoint via OS command injection directly enables exploitation of public-facing applications (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates OS command injection (CWE-78) in the /api/aaa;/../register endpoint by requiring validation of all information inputs to prevent malicious command execution.
Requires identification, reporting, and correction of the specific flaw in Antabot White-Jotter up to commit 9bcadc, preventing exploitation of this RCE vulnerability.
Limits the scope of unauthenticated actions on publicly accessible endpoints like /api/aaa;/../register, preventing RCE by restricting permitted functions without identification or authentication.