{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-7451","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","state":"PUBLISHED","assignerShortName":"twcert","dateReserved":"2025-07-11T08:38:34.348Z","datePublished":"2025-07-14T02:35:39.554Z","dateUpdated":"2025-07-14T14:44:00.805Z"},"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"iSherlock-maillog-4.5","vendor":"Hgiga","versions":[{"lessThan":"137","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"iSherlock-smtp-4.5","vendor":"Hgiga","versions":[{"lessThan":"732","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"iSherlock-maillog-5.5","vendor":"Hgiga","versions":[{"lessThan":"137","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"iSherlock-smtp-5.5","vendor":"Hgiga","versions":[{"lessThan":"732","status":"affected","version":"0","versionType":"custom"}]}],"datePublic":"2025-07-14T02:28:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. This vulnerability has already been exploited. Please update immediately."}],"value":"The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. This vulnerability has already been exploited. Please update immediately."}],"impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","shortName":"twcert","dateUpdated":"2025-07-14T02:41:07.255Z"},"references":[{"tags":["third-party-advisory"],"url":"https://www.twcert.org.tw/tw/cp-132-10237-9e0f7-1.html"},{"tags":["third-party-advisory"],"url":"https://www.twcert.org.tw/en/cp-139-10238-f2bba-2.html"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update package iSherlock-maillog-4.5 to version 137 or later<br>Update package iSherlock-smtp-4.5 to version 732 or later<br>Update package iSherlock-maillog-5.5 to version 137 or later<br>Update package iSherlock-smtp-5.5 to version 732 or later<br>"}],"value":"Update package iSherlock-maillog-4.5 to version 137 or later\nUpdate package iSherlock-smtp-4.5 to version 732 or later\nUpdate package iSherlock-maillog-5.5 to version 137 or later\nUpdate package iSherlock-smtp-5.5 to version 732 or later"}],"source":{"advisory":"TVN-202507003","discovery":"EXTERNAL"},"title":"Hgiga｜iSherlock - OS Command Injection","x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-14T14:01:21.072338Z","id":"CVE-2025-7451","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-07-14T14:44:00.805Z"}}]}}