Cyber Resilience

CVE-2025-7343

Critical

Published: 21 July 2025

Published
21 July 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0031 54.9th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-7343 is a critical-severity SQL Injection (CWE-89) vulnerability in Org (inferred from references). Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-7343 is a SQL injection vulnerability (CWE-89) in the SFT software developed by Digiwin. Published on 2025-07-21, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical. The flaw enables unauthenticated remote attackers to inject arbitrary SQL commands into the application.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges or user interaction. Successful exploitation allows them to read, modify, and delete database contents, resulting in high impacts to confidentiality, integrity, and availability.

Advisories from Digiwin and TWCERT/CC provide further details on the issue, available at https://www.digiwin.com/tw/news/3568.html, https://www.twcert.org.tw/en/cp-139-10271-25ea9-2.html, and https://www.twcert.org.tw/tw/cp-132-10270-83d95-1.html. Security practitioners should consult these for mitigation guidance and patch information.

EU & UK References

Vulnerability details

The SFT developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct unauthenticated remote SQL injection in a public-facing application enables initial access via exploitation of the exposed service.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89
CVE-2026-31871Shared CWE-89
CVE-2026-33078Shared CWE-89
CVE-2026-46359Shared CWE-89
CVE-2025-22691Shared CWE-89

Affected Assets

Org
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates SQL injection by requiring validation and sanitization of user inputs before they are used in database queries.

SI-2 Flaw Remediation good match
prevent

Addresses the specific SQL injection flaw in the SFT software by mandating timely patching and remediation as advised by Digiwin.

SI-4 System Monitoring partial match
detect

Enables monitoring of system and database activity to detect anomalous queries or access patterns indicative of SQL injection exploitation.

References