CVE-2025-7451
Published: 14 July 2025
Summary
CVE-2025-7451 is a critical-severity OS Command Injection (CWE-78) vulnerability in Org (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The iSherlock product developed by Hgiga contains an OS command injection vulnerability tracked as CVE-2025-7451 and assigned CWE-78. The flaw allows unauthenticated remote attackers to supply arbitrary operating-system commands that are executed on the server, rated at CVSS 9.3 with a network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability.
Unauthenticated attackers reachable over the network can exploit the weakness to run arbitrary commands, resulting in complete compromise of the affected server. The vulnerability has already been exploited in the wild.
Public advisories published by Taiwan’s CERT on 14 July 2025 explicitly instruct administrators to apply vendor updates immediately; the referenced bulletins are available at the two twcert.org.tw URLs listed for the CVE.
The EPSS score has remained flat at 0.0107 from disclosure through the present peak, indicating no material increase in observed exploitation interest after publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21302
Vulnerability details
The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. This vulnerability has already been exploited. Please update immediately.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing server software directly enables unauthenticated remote exploitation (T1190) leading to arbitrary command execution via OS shell (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the OS command injection vulnerability through timely flaw prioritization, testing, and patching as urged by vendor advisories.
Prevents OS command injection attacks by validating and sanitizing untrusted remote inputs to block arbitrary command execution.
Enables detection of active exploitation by monitoring system processes, network traffic, and logs for indicators of unauthorized OS command execution.