CVE-2025-6785
Raw vector
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:L/U:AmberSummary
CVE-2025-6785 is a medium-severity Injection (CWE-74) vulnerability in Asrg (inferred from references). Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Replication Through Removable Media (T1091); ranked at the 13th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to PE-2 (Physical Access Authorizations) and PE-3 (Physical Access Control) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28895
Vulnerability Data
Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed CAN messages to control remote start functions of the vehicle. Testing completed on Tesla Model 3 vehicles with software version…
more
v11.1 (2023.20.9 ee6de92ddac5). This issue affects Model 3: With software versions from 2023.Xx before 2023.44.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 6 hardening rules · 3 OS baselines
V1.2.1V1.2.3V1.2.5V1.2.8
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces physical access authorizations at entry points to restricted areas.
Maintains the authorized physical access list that the system must enforce.
Monitors physical access to detect unauthorized entry after the fact.
SI-10 directly requires validation of information inputs to reject malformed or special-element content before it reaches downstream parsers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Specifies physical entry controls that prevent unauthorized actors from reaching protected information or assets.
Defines physical perimeters that directly limit unauthorized physical access to restricted areas.
Secure disposal prevents data exposure after equipment leaves controlled areas.
Requires securing offices, rooms and facilities to restrict physical access to areas containing sensitive information.
Monitoring supports detection but does not itself prevent unauthorized physical access.
Equipment siting helps reduce exposure but is secondary to access-control measures.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248537 OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance. prevents CWE-1263
- V-248540 OL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes. prevents CWE-1263
RHEL 7 (2 rules)
- V-204440 Red Hat Enterprise Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes. prevents CWE-1263
- V-204438 Red Hat Enterprise Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes. prevents CWE-1263