CVE-2025-61879
Published: 12 February 2026
Summary
CVE-2025-61879 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Infoblox Nios. Its CVSS base score is 7.7 (High).
Operationally, ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-61879 is a vulnerability in Infoblox NIOS versions through 9.0.7 that allows a high-privileged user to trigger an arbitrary file write via the account creation mechanism. It is rated with a CVSS v3.1 base score of 7.7 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) and is associated with CWEs-73 (External Control of File Name or Path) and CWE-284 (Improper Access Control). The issue was published on 2026-02-12.
A high-privileged user with network access can exploit this vulnerability through the account creation process, which requires high attack complexity but no user interaction. Successful exploitation enables arbitrary file writes, resulting in high confidentiality and integrity impacts due to the changed scope, though availability is unaffected.
Infoblox advisories provide details on this vulnerability, including CVE-2025-61879 and the related CVE-2025-61880, available at https://infoblox.com and https://support.infoblox.com/s/article/CVE-2025-61879-and-CVE-2025-61880.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207239
Vulnerability details
In Infoblox NIOS through 9.0.7, a High-Privileged User Can Trigger an Arbitrary File Write via the Account Creation Mechanism.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CWE-73 by validating inputs to the account creation mechanism, preventing external control of file names or paths that enable arbitrary file writes.
Enforces least privilege to ensure high-privileged users lack unnecessary file write capabilities, blocking exploitation of the account creation mechanism.
Addresses CWE-284 by enforcing access control policies that prevent high-privileged users from performing unauthorized arbitrary file writes via account creation.