CVE-2025-9588
Published: 23 September 2025
Summary
CVE-2025-9588 is a critical-severity OS Command Injection (CWE-78) vulnerability in Ironmountain Envision. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 43.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of information inputs, directly preventing OS command injection by neutralizing special elements used in OS commands.
SI-2 mandates timely flaw remediation, directly addressing this CVE by applying the vendor patch to EnVision version 250563 or later.
AC-6 enforces least privilege, limiting the impact of arbitrary OS command execution by restricting privileges of the affected EnVision process.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection (CWE-78) in a public-facing application directly enables remote unauthenticated arbitrary command execution (T1190) and use of command interpreters/shells on the host OS (T1059).
NVD Description
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection.This issue affects enVision: before 250563.
Deeper analysisAI
CVE-2025-9588 is an OS Command Injection vulnerability (CWE-78) in Iron Mountain Archiving Services Inc.'s EnVision product. It stems from improper neutralization of special elements used in an OS command, enabling command injection. The issue affects EnVision versions before 250563 and was published on 2025-09-23 with a maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Remote attackers require no privileges or user interaction to exploit this over the network with low complexity. Successful exploitation allows arbitrary command execution on the underlying OS, resulting in high-impact confidentiality, integrity, and availability violations, including potential full system compromise due to the changed scope.
The Turkish National Cyber Incident Response Center (USOM) has issued an advisory at https://www.usom.gov.tr/bildirim/tr-25-0285 detailing the vulnerability.
Details
- CWE(s)