CVE-2025-66620
Columbiaweather Weather Microserver Firmware ≤ MS_4.1_14142
Raw vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-66620 is a high-severity Command Shell in Externally Accessible Directory (CWE-553) vulnerability in Columbiaweather Weather Microserver Firmware. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-2 (Baseline Configuration) and CM-6 (Configuration Settings) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-66620 is a vulnerability in MicroServer involving an unused webshell that permits unlimited login attempts and grants sudo rights on certain files and directories. This issue, associated with CWE-553, affects the MicroServer component and carries a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts with low attack complexity and privileges required from an adjacent network.
An attacker with admin access to MicroServer can exploit this vulnerability to obtain limited shell access. This enables persistence mechanisms such as reverse shells, along with the capability to modify or remove data stored in the file system.
Mitigation details are outlined in advisories including ICSA-26-006-01 from CISA (https://www.cisa.gov/news-events/ics-advisories/icsa-26-006-01) and the corresponding CSAF document (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-006-01.json). The vulnerability was published on 2026-01-07.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1166
Vulnerability Data
An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. An attacker with admin access to MicroServer can gain limited shell access, enabling persistence through reverse shells, and the ability to modify or…
more
remove data stored in the file system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Secure baseline configurations explicitly exclude dangerous executables such as shells from web-accessible directories.
Documented secure configuration settings prohibit placement of command shells in externally reachable paths such as cgi-bin.
Least-functionality rules restrict installation and exposure of unnecessary interpreters or shells in public directories.
Vulnerability scanning can locate and report executable shells present in web-accessible directories after deployment.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened baselines and configuration management directly prohibit placing executable shells in web-accessible directories.
Execution allow-listing or restriction prevents the dangerous shell from running even if present.
Web-server and file monitoring can detect the presence or use of the unauthorized shell.
Vulnerability scanning can discover the exposed shell before exploitation.
Least-privilege directory permissions can block unauthorized placement or execution of the shell.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover such files but does not prevent their introduction during development.
Restricting software installation prevents unauthorized shell scripts from being placed in web-accessible directories.
Network controls can limit exposure of the directory but do not address the presence of the shell itself.
Network segregation reduces reachability of the vulnerable directory but does not eliminate the weakness.
Secure development lifecycle practices include review and removal of dangerous files before deployment.
Secure architecture principles discourage exposing executable directories but do not directly prevent the weakness.