CVE-2025-61196
Published: 30 October 2025
Summary
CVE-2025-61196 is a high-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-61196 is a code injection vulnerability (CWE-94) in BusinessNext CRMnext version 10.8.3.0. The flaw allows a remote attacker to execute arbitrary code by exploiting the comments input parameter. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high severity due to its potential for significant impact.
A remote attacker with low privileges, such as an authenticated user, can exploit the vulnerability over the network with low attack complexity and without requiring user interaction. Successful exploitation enables arbitrary code execution on the affected system, resulting in high impacts to confidentiality, integrity, and availability.
References for further details, including potential exploitation information, are provided in the GitHub repository at https://github.com/zsamamah/CVE-2025-61196/blob/main/CVE-2025-61196.md. No vendor-specific patches or mitigation guidance are detailed in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-37045
Vulnerability details
An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a code injection flaw in a public-facing CRM web application (BusinessNext CRMnext), enabling remote arbitrary code execution, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates code injection vulnerability by requiring validation and sanitization of untrusted inputs like the comments parameter to prevent arbitrary code execution.
Addresses the root cause by requiring timely identification, reporting, and remediation of the specific code injection flaw in CRMnext v.10.8.3.0.
Provides defense-in-depth protection against execution of injected code via memory protections such as non-executable memory regions.