{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-24061", "aliases": [], "title": "Inetutils：認証の回避", "summary": "GNU Inetutils の telnetd（バージョン 2.7 まで）では、USER 環境変数に \"-f root\" を設定すると、リモートから認証をバイパスできる。", "risk": "認証バイパスにより、攻撃者が正当なユーザーとしてログインできる可能性がある。", "product": "Inetutils", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Inetutils", "range": ">= 1.9.3 / <= 2.7" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-24061", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-24061", "label": "CVE公式レコード" }, { "url": "https://www.openwall.com/lists/oss-security/2026/01/20/2", "label": "CVE掲載の参考情報" }, { "url": "https://www.openwall.com/lists/oss-security/2026/01/20/8", "label": "CVE掲載の参考情報" }, { "url": "https://www.gnu.org/software/inetutils/", "label": "CVE掲載の参考情報" }, { "url": "https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html", "label": "CVE掲載の参考情報" }, { "url": "https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b", "label": "CISAが示す関連情報" }, { "url": "https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc", "label": "CISAが示す関連情報" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package", "label": "CVE掲載の参考情報" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package", "label": "CVE掲載の参考情報" }, { "url": "https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass", "label": "CVE掲載の参考情報" }, { "url": "https://cgit.git.savannah.gnu.org/cgit/inetutils.git", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24061", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-01-21T06:42:17.134Z", "modifiedAt": "2026-09-29T19:43:14.235Z", "fetchedAt": "2026-10-23T02:43:48.003Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unknown", "product": "Inetutils", "vendor": "GNU", "versions": [ { "lessThanOrEqual": "2.7", "status": "affected", "version": "1.9.3", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-24061", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json", "fetchedAt": "2026-10-23T02:43:48.003Z", "publishedAt": "2026-01-21T06:42:17.134Z", "modifiedAt": "2026-09-29T19:43:14.235Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "GNU", "product": "Inetutils", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "1.9.3", "lessThanOrEqual": "2.7", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-88", "lang": "en", "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.openwall.com/lists/oss-security/2026/01/20/2", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.openwall.com/lists/oss-security/2026/01/20/8", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.gnu.org/software/inetutils/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/2" }, { "url": "https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/3" }, { "url": "https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/4" }, { "url": "https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/5" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/6" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/7" }, { "url": "https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/8" }, { "url": "https://www.openwall.com/lists/oss-security/2026/01/20/2#:~:text=root@...a%3A~%20USER='", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.html", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24061", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/22/1", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00025.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unknown\",\"product\":\"Inetutils\",\"vendor\":\"GNU\",\"versions\":[{\"lessThanOrEqual\":\"2.7\",\"status\":\"affected\",\"version\":\"1.9.3\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-88\",\"description\":\"CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-29T19:43:14.235Z", "fetchedAt": "2026-10-23T02:43:48.003Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-01-26T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Inetutilsに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:11.292Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "cfa66c9d5939f9bb445cd24ccd03a674ae3d542d8599df203ef958ee6467f9fd", "sourceModifiedAt": "2026-09-29T19:43:14.235Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "GNU Inetutils の telnetd（バージョン 2.7 まで）では、USER 環境変数に \"-f root\" を設定すると、リモートから認証をバイパスできる。", "risk": "認証バイパスにより、攻撃者が正当なユーザーとしてログインできる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "GNU Inetutils の telnetd が、バージョン 1.9.3 から 2.7（含む）までの範囲で影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：GNU / Inetutils。影響ありとして記載：1.9.3以上、2.7以下。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-24061" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Inetutils」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-24061", "https://www.openwall.com/lists/oss-security/2026/01/20/2", "https://www.openwall.com/lists/oss-security/2026/01/20/8", "https://www.gnu.org/software/inetutils/", "https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html", "https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b", "https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc", "https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package", "https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package", "https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-24061", "https://cgit.git.savannah.gnu.org/cgit/inetutils.git", "https://nvd.nist.gov/vuln/detail/CVE-2026-24061" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-24061", "https://www.openwall.com/lists/oss-security/2026/01/20/2", "https://www.openwall.com/lists/oss-security/2026/01/20/8", "https://www.gnu.org/software/inetutils/", "https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html", "https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b", "https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc", "https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package", "https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package", "https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-24061", "https://cgit.git.savannah.gnu.org/cgit/inetutils.git", "https://nvd.nist.gov/vuln/detail/CVE-2026-24061" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-24061", "https://www.openwall.com/lists/oss-security/2026/01/20/2", "https://www.openwall.com/lists/oss-security/2026/01/20/8", "https://www.gnu.org/software/inetutils/", "https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html", "https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b", "https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc", "https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package", "https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package", "https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-24061", "https://cgit.git.savannah.gnu.org/cgit/inetutils.git", "https://nvd.nist.gov/vuln/detail/CVE-2026-24061" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-24061", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-24061", "label": "CVE公式レコード" }, { "url": "https://www.openwall.com/lists/oss-security/2026/01/20/2", "label": "CVE掲載の参考情報" }, { "url": "https://www.openwall.com/lists/oss-security/2026/01/20/8", "label": "CVE掲載の参考情報" }, { "url": "https://www.gnu.org/software/inetutils/", "label": "CVE掲載の参考情報" }, { "url": "https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html", "label": "CVE掲載の参考情報" }, { "url": "https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b", "label": "CISAが示す関連情報" }, { "url": "https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc", "label": "CISAが示す関連情報" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package", "label": "CVE掲載の参考情報" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package", "label": "CVE掲載の参考情報" }, { "url": "https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass", "label": "CVE掲載の参考情報" }, { "url": "https://cgit.git.savannah.gnu.org/cgit/inetutils.git", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24061", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24061.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unknown\",\"product\":\"Inetutils\",\"vendor\":\"GNU\",\"versions\":[{\"lessThanOrEqual\":\"2.7\",\"status\":\"affected\",\"version\":\"1.9.3\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-24061", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-24061\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-24061（Inetutils）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・GNU Inetutils の telnetd が、バージョン 1.9.3 から 2.7（含む）までの範囲で影響を受ける。\n・公式の対象表：GNU / Inetutils。影響ありとして記載：1.9.3以上、2.7以下。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-24061", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:11.292Z", "lastSuccess": "2026-10-23T03:25:11.292Z", "sourceCheckedAt": "2026-10-23T02:43:48.003Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-37079", "aliases": [], "title": "VMware vCenter Server / VMware Cloud Foundation：コード実行", "summary": "vCenter Server は DCERPC プロトコルの実装にヒープオーバーフローの脆弱性を含んでいます。ネットワークから vCenter Server にアクセスできる攻撃者は、特別に細工したネットワークパケットを送ることでこの脆弱性を発動させ、サーバー上で攻撃者のコードを実行させられる可能性があります。", "risk": "攻撃者がコードを実行できるため、サーバー上で任意の処理が行われる可能性があります。", "product": "VMware vCenter Server / VMware Cloud Foundation", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "vmware", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "VMware vCenter Server", "range": ">= 8.0 / < 8.0 U2d" }, { "product": "VMware vCenter Server", "range": ">= 8.0 / < 8.0 U1e" }, { "product": "VMware vCenter Server", "range": ">= 7.0 / < 7.0 U3r" }, { "product": "VMware Cloud Foundation", "range": "5.x" }, { "product": "VMware Cloud Foundation", "range": "4.x" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json", "label": "CVE：vmware" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-37079", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-37079", "label": "CVE公式レコード" }, { "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37079", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-06-18T05:43:06.619Z", "modifiedAt": "2026-01-24T04:55:16.029Z", "fetchedAt": "2026-10-23T02:43:31.925Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "VMware vCenter Server", "vendor": "n/a", "versions": [ { "lessThan": "8.0 U2d", "status": "affected", "version": "8.0", "versionType": "custom" }, { "lessThan": "8.0 U1e", "status": "affected", "version": "8.0", "versionType": "custom" }, { "lessThan": "7.0 U3r", "status": "affected", "version": "7.0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "VMware Cloud Foundation", "vendor": "n/a", "versions": [ { "status": "affected", "version": "5.x" }, { "status": "affected", "version": "4.x" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-37079", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json", "fetchedAt": "2026-10-23T02:43:31.925Z", "publishedAt": "2024-06-18T05:43:06.619Z", "modifiedAt": "2026-01-24T04:55:16.029Z", "state": "published", "provider": "vmware", "title": "", "descriptions": [ { "lang": "en", "value": "vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "VMware vCenter Server", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.0", "lessThan": "8.0 U2d", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.0", "lessThan": "8.0 U1e", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "7.0", "lessThan": "7.0 U3r", "versionType": "custom", "status": "affected" } ] }, { "vendor": "n/a", "product": "VMware Cloud Foundation", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "5.x", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "4.x", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Heap-overflow vulnerability", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "vmware", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-37079", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"VMware vCenter Server\",\"vendor\":\"n/a\",\"versions\":[{\"lessThan\":\"8.0 U2d\",\"status\":\"affected\",\"version\":\"8.0\",\"versionType\":\"custom\"},{\"lessThan\":\"8.0 U1e\",\"status\":\"affected\",\"version\":\"8.0\",\"versionType\":\"custom\"},{\"lessThan\":\"7.0 U3r\",\"status\":\"affected\",\"version\":\"7.0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"VMware Cloud Foundation\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"5.x\"},{\"status\":\"affected\",\"version\":\"4.x\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Heap-overflow vulnerability\",\"lang\":\"en\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-01-24T04:55:16.029Z", "fetchedAt": "2026-10-23T02:43:31.925Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-01-23T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "VMware vCenter Server / VMware Cloud Foundationにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:11.557Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "57feb46c4fb7a84c84e0b6ad72faf47834c4d80367444050de34a1e6ae6dcd71", "sourceModifiedAt": "2026-01-24T04:55:16.029Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "vCenter Server は DCERPC プロトコルの実装にヒープオーバーフローの脆弱性を含んでいます。ネットワークから vCenter Server にアクセスできる攻撃者は、特別に細工したネットワークパケットを送ることでこの脆弱性を発動させ、サーバー上で攻撃者のコードを実行させられる可能性があります。", "risk": "攻撃者がコードを実行できるため、サーバー上で任意の処理が行われる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "VMware vCenter Server のバージョン 8.0 で、8.0 U2d 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json" ], "evidenceIds": [ "E2" ] }, { "text": "VMware vCenter Server のバージョン 8.0 で、8.0 U1e 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json" ], "evidenceIds": [ "E2" ] }, { "text": "VMware vCenter Server のバージョン 7.0 で、7.0 U3r 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json" ], "evidenceIds": [ "E2" ] }, { "text": "VMware Cloud Foundation のバージョン 5.x は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json" ], "evidenceIds": [ "E3" ] }, { "text": "VMware Cloud Foundation のバージョン 4.x は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：VMware vCenter Server。影響ありとして記載：8.0以上、8.0 U2d未満。影響ありとして記載：8.0以上、8.0 U1e未満。影響ありとして記載：7.0以上、7.0 U3r未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：VMware Cloud Foundation。影響ありとして記載：5.x。影響ありとして記載：4.x。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-37079" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json" ], "evidenceIds": [ "E2" ] }, { "text": "「VMware vCenter Server / VMware Cloud Foundation」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-37079", "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-37079", "https://nvd.nist.gov/vuln/detail/CVE-2024-37079" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-37079", "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-37079", "https://nvd.nist.gov/vuln/detail/CVE-2024-37079" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-37079", "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-37079", "https://nvd.nist.gov/vuln/detail/CVE-2024-37079" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json", "label": "CVE：vmware" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-37079", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-37079", "label": "CVE公式レコード" }, { "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37079", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"VMware vCenter Server\",\"vendor\":\"n/a\",\"versions\":[{\"lessThan\":\"8.0 U2d\",\"status\":\"affected\",\"version\":\"8.0\",\"versionType\":\"custom\"},{\"lessThan\":\"8.0 U1e\",\"status\":\"affected\",\"version\":\"8.0\",\"versionType\":\"custom\"},{\"lessThan\":\"7.0 U3r\",\"status\":\"affected\",\"version\":\"7.0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/37xxx/CVE-2024-37079.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"VMware Cloud Foundation\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"5.x\"},{\"status\":\"affected\",\"version\":\"4.x\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-37079", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-37079\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-37079（VMware vCenter Server / VMware Cloud Foundation）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・VMware vCenter Server のバージョン 8.0 で、8.0 U2d 未満のものは影響を受けます。\n・VMware vCenter Server のバージョン 8.0 で、8.0 U1e 未満のものは影響を受けます。\n・VMware vCenter Server のバージョン 7.0 で、7.0 U3r 未満のものは影響を受けます。\n・VMware Cloud Foundation のバージョン 5.x は影響を受けます。\n・VMware Cloud Foundation のバージョン 4.x は影響を受けます。\n・公式の対象表：VMware vCenter Server。影響ありとして記載：8.0以上、8.0 U2d未満。影響ありとして記載：8.0以上、8.0 U1e未満。影響ありとして記載：7.0以上、7.0 U3r未満。\n・公式の対象表：VMware Cloud Foundation。影響ありとして記載：5.x。影響ありとして記載：4.x。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-37079", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:11.557Z", "lastSuccess": "2026-10-23T03:25:11.557Z", "sourceCheckedAt": "2026-10-23T02:43:31.925Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-31125", "aliases": [], "title": "vite：脆弱性情報", "summary": "Vite の server.fs.deny が ?import クエリ付きの inline と raw でバイパスされ、許可されていないファイルの内容が外部に公開されます。ネットワークに Vite 開発サーバーを公開しているアプリだけが影響を受けます。", "risk": "許可されていないファイルの内容が外部に漏洩し、機密情報が不正な者に取得される可能性があります。", "product": "vite", "category": "other", "component": "package", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "GitHub_M", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "affected": [ { "product": "vite", "range": ">= 6.2.0, < 6.2.4" }, { "product": "vite", "range": ">= 6.1.0, < 6.1.3" }, { "product": "vite", "range": ">= 6.0.0, < 6.0.13" }, { "product": "vite", "range": ">= 5.0.0, < 5.4.16" }, { "product": "vite", "range": "< 4.5.11" } ], "fixed": [], "steps": [ "影響を受けるバージョンを 6.2.4、6.1.3、6.0.13、5.4.16、または 4.5.11 以上にアップデートすることで修正されます。", "「CVE-2025-31125」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31125", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-31125", "label": "CVE公式レコード" }, { "url": "https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8", "label": "https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8" }, { "url": "https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31125", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-31T17:06:30.704Z", "modifiedAt": "2026-01-23T16:58:37.048Z", "fetchedAt": "2026-10-23T02:43:37.437Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.", "sourceTitle": "Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "vitejs", "product": "vite", "versions": [ { "version": ">= 6.2.0, < 6.2.4", "status": "affected" }, { "version": ">= 6.1.0, < 6.1.3", "status": "affected" }, { "version": ">= 6.0.0, < 6.0.13", "status": "affected" }, { "version": ">= 5.0.0, < 5.4.16", "status": "affected" }, { "version": "< 4.5.11", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-31125", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json", "fetchedAt": "2026-10-23T02:43:37.437Z", "publishedAt": "2025-03-31T17:06:30.704Z", "modifiedAt": "2026-01-23T16:58:37.048Z", "state": "published", "provider": "GitHub_M", "title": "Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query", "descriptions": [ { "lang": "en", "value": "Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "vitejs", "product": "vite", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": ">= 6.2.0, < 6.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": ">= 6.1.0, < 6.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": ">= 6.0.0, < 6.0.13", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": ">= 5.0.0, < 5.4.16", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "< 4.5.11", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "provider": "GitHub_M", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949", "label": "https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"vitejs\",\"product\":\"vite\",\"versions\":[{\"version\":\">= 6.2.0, < 6.2.4\",\"status\":\"affected\"},{\"version\":\">= 6.1.0, < 6.1.3\",\"status\":\"affected\"},{\"version\":\">= 6.0.0, < 6.0.13\",\"status\":\"affected\"},{\"version\":\">= 5.0.0, < 5.4.16\",\"status\":\"affected\"},{\"version\":\"< 4.5.11\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-200\",\"lang\":\"en\",\"description\":\"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"cweId\":\"CWE-284\",\"lang\":\"en\",\"description\":\"CWE-284: Improper Access Control\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"REQUIRED\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-01-23T16:58:37.048Z", "fetchedAt": "2026-10-23T02:43:37.437Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-01-22T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "viteに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:12.589Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d79a3201191b137e590dda865d277b25de1366f39dc0ce64f219aa3350b1a2db", "sourceModifiedAt": "2026-01-23T16:58:37.048Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Vite の server.fs.deny が ?import クエリ付きの inline と raw でバイパスされ、許可されていないファイルの内容が外部に公開されます。ネットワークに Vite 開発サーバーを公開しているアプリだけが影響を受けます。", "risk": "許可されていないファイルの内容が外部に漏洩し、機密情報が不正な者に取得される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3", "E4" ], "applicability": [ { "text": "ネットワークに Vite 開発サーバーを公開している（--host オプションまたは server.host 設定を使用）アプリだけが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "バージョン 6.2.0 以上 6.2.4 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "バージョン 6.1.0 以上 6.1.3 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "バージョン 6.0.0 以上 6.0.13 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "バージョン 5.0.0 以上 5.4.16 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "バージョン 4.5.11 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "公式の対象表：vitejs / vite。影響ありとして記載：>= 6.2.0, < 6.2.4。影響ありとして記載：>= 6.1.0, < 6.1.3。影響ありとして記載：>= 6.0.0, < 6.0.13。影響ありとして記載：>= 5.0.0, < 5.4.16。影響ありとして記載：< 4.5.11。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31125" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json" ], "evidenceIds": [ "E5" ] }, { "text": "「vite」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-31125", "https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8", "https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31125", "https://nvd.nist.gov/vuln/detail/CVE-2025-31125" ] } ], "actions": [ { "text": "影響を受けるバージョンを 6.2.4、6.1.3、6.0.13、5.4.16、または 4.5.11 以上にアップデートすることで修正されます。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json" ], "evidenceIds": [ "E1" ] }, { "text": "「CVE-2025-31125」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-31125", "https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8", "https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31125", "https://nvd.nist.gov/vuln/detail/CVE-2025-31125" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-31125", "https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8", "https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31125", "https://nvd.nist.gov/vuln/detail/CVE-2025-31125" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-31125", "https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8", "https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31125", "https://nvd.nist.gov/vuln/detail/CVE-2025-31125" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json" ], "evidenceIds": [ "E5" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-31125", "https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8", "https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31125", "https://nvd.nist.gov/vuln/detail/CVE-2025-31125" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31125", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-31125", "label": "CVE公式レコード" }, { "url": "https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8", "label": "https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8" }, { "url": "https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31125", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json", "sourceField": "/containers/cna/title", "excerpt": "Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"cweId\":\"CWE-200\",\"lang\":\"en\",\"description\":\"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\",\"type\":\"CWE\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json", "sourceField": "/containers/cna/problemTypes/1/descriptions/0", "excerpt": "{\"cweId\":\"CWE-284\",\"lang\":\"en\",\"description\":\"CWE-284: Improper Access Control\",\"type\":\"CWE\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31125.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"vitejs\",\"product\":\"vite\",\"versions\":[{\"version\":\">= 6.2.0, < 6.2.4\",\"status\":\"affected\"},{\"version\":\">= 6.1.0, < 6.1.3\",\"status\":\"affected\"},{\"version\":\">= 6.0.0, < 6.0.13\",\"status\":\"affected\"},{\"version\":\">= 5.0.0, < 5.4.16\",\"status\":\"affected\"},{\"version\":\"< 4.5.11\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31125", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-31125\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-31125（vite）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・ネットワークに Vite 開発サーバーを公開している（--host オプションまたは server.host 設定を使用）アプリだけが影響を受けます。\n・バージョン 6.2.0 以上 6.2.4 未満は影響を受けます。\n・バージョン 6.1.0 以上 6.1.3 未満は影響を受けます。\n・バージョン 6.0.0 以上 6.0.13 未満は影響を受けます。\n・バージョン 5.0.0 以上 5.4.16 未満は影響を受けます。\n・バージョン 4.5.11 未満は影響を受けます。\n・公式の対象表：vitejs / vite。影響ありとして記載：>= 6.2.0, < 6.2.4。影響ありとして記載：>= 6.1.0, < 6.1.3。影響ありとして記載：>= 6.0.0, < 6.0.13。影響ありとして記載：>= 5.0.0, < 5.4.16。影響ありとして記載：< 4.5.11。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-31125", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:12.589Z", "lastSuccess": "2026-10-23T03:25:12.589Z", "sourceCheckedAt": "2026-10-23T02:43:37.437Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-34026", "aliases": [], "title": "Concerto：認証の回避", "summary": "Versa Concerto SD-WAN オーケストレーションプラットフォームの Traefik リバースプロキシ設定に認証バイパスの脆弱性があり、攻撃者が管理用エンドポイントにアクセスできるようになります。内部の Actuator エンドポイントを利用すると、ヒープダンプやトレースログを取得できる可能性があります。", "risk": "攻撃者が管理エンドポイントにアクセスし、ヒープダンプやトレースログを取得できるため、システム内部の情報が漏洩する恐れがあります。", "product": "Concerto", "category": "other", "component": "package", "severity": "critical", "cvss": 9.2, "cvssVersion": "4.0", "cvssSource": "VulnCheck", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N", "affected": [ { "product": "Concerto", "range": ">= 12.1.2 / <= 12.2.0（機能: Traefik）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json", "label": "CVE：VulnCheck" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-34026", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-34026", "label": "CVE公式レコード" }, { "url": "https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce", "label": "CVE掲載の参考情報" }, { "url": "https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34026", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-05-21T22:04:58.832Z", "modifiedAt": "2026-01-23T14:34:06.013Z", "fetchedAt": "2026-10-23T02:43:37.909Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.", "sourceTitle": "Versa Concerto Actuator Authentication Bypass Information Leak", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unknown", "modules": [ "Traefik" ], "product": "Concerto", "vendor": "Versa", "versions": [ { "lessThanOrEqual": "12.2.0", "status": "affected", "version": "12.1.2", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: Traefik。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-34026", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json", "fetchedAt": "2026-10-23T02:43:37.909Z", "publishedAt": "2025-05-21T22:04:58.832Z", "modifiedAt": "2026-01-23T14:34:06.013Z", "state": "published", "provider": "VulnCheck", "title": "Versa Concerto Actuator Authentication Bypass Information Leak", "descriptions": [ { "lang": "en", "value": "The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Versa", "product": "Concerto", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [ "Traefik" ], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.1.2", "lessThanOrEqual": "12.2.0", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-288", "lang": "en", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N", "baseScore": 9.2, "baseSeverity": "CRITICAL", "provider": "VulnCheck", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34026", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e", "label": "CISA-ADP", "tags": [ "vendor-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/2" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unknown\",\"modules\":[\"Traefik\"],\"product\":\"Concerto\",\"vendor\":\"Versa\",\"versions\":[{\"lessThanOrEqual\":\"12.2.0\",\"status\":\"affected\",\"version\":\"12.1.2\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-288\",\"description\":\"CWE-288 Authentication Bypass Using an Alternate Path or Channel\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"attackVector\":\"NETWORK\",\"baseScore\":9.2,\"baseSeverity\":\"CRITICAL\",\"exploitMaturity\":\"NOT_DEFINED\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"LOW\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"NONE\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-01-23T14:34:06.013Z", "fetchedAt": "2026-10-23T02:43:37.909Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-01-22T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Concertoに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:13.076Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "0c96aa6244e9b5ff3f40fe0a2b24bf78d8f1da8fc7fab1cb13406c8891c3d2c6", "sourceModifiedAt": "2026-01-23T14:34:06.013Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Versa Concerto SD-WAN オーケストレーションプラットフォームの Traefik リバースプロキシ設定に認証バイパスの脆弱性があり、攻撃者が管理用エンドポイントにアクセスできるようになります。内部の Actuator エンドポイントを利用すると、ヒープダンプやトレースログを取得できる可能性があります。", "risk": "攻撃者が管理エンドポイントにアクセスし、ヒープダンプやトレースログを取得できるため、システム内部の情報が漏洩する恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は Versa 社の Concerto SD-WAN オーケストレーションプラットフォームです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "脆弱性は Traefik リバースプロキシの設定に起因し、認証バイパスが可能になります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "影響を受けるバージョンは 12.1.2 から 12.2.0 までです（それ以外のバージョンでも脆弱な可能性があります）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json" ], "evidenceIds": [ "E1", "E3", "E2" ] }, { "text": "公式の対象表：Versa / Concerto。影響ありとして記載：12.1.2以上、12.2.0以下。対象の機能：Traefik。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-34026" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Concerto」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-34026", "https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-34026", "https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e", "https://nvd.nist.gov/vuln/detail/CVE-2025-34026" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-34026", "https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-34026", "https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e", "https://nvd.nist.gov/vuln/detail/CVE-2025-34026" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-34026", "https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-34026", "https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e", "https://nvd.nist.gov/vuln/detail/CVE-2025-34026" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json", "label": "CVE：VulnCheck" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-34026", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-34026", "label": "CVE公式レコード" }, { "url": "https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce", "label": "CVE掲載の参考情報" }, { "url": "https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34026", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json", "sourceField": "/containers/cna/title", "excerpt": "Versa Concerto Actuator Authentication Bypass Information Leak", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/34xxx/CVE-2025-34026.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unknown\",\"modules\":[\"Traefik\"],\"product\":\"Concerto\",\"vendor\":\"Versa\",\"versions\":[{\"lessThanOrEqual\":\"12.2.0\",\"status\":\"affected\",\"version\":\"12.1.2\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-34026", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-34026\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-34026（Concerto）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は Versa 社の Concerto SD-WAN オーケストレーションプラットフォームです。\n・脆弱性は Traefik リバースプロキシの設定に起因し、認証バイパスが可能になります。\n・影響を受けるバージョンは 12.1.2 から 12.2.0 までです（それ以外のバージョンでも脆弱な可能性があります）。\n・公式の対象表：Versa / Concerto。影響ありとして記載：12.1.2以上、12.2.0以下。対象の機能：Traefik。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-34026", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:13.076Z", "lastSuccess": "2026-10-23T03:25:13.076Z", "sourceCheckedAt": "2026-10-23T02:43:37.909Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-54313", "aliases": [], "title": "eslint-config-prettier：脆弱性情報", "summary": "eslint-config-prettier のバージョン 8.10.1、9.1.1、10.1.6、10.1.7 にはサプライチェーン攻撃用の悪意あるコードが埋め込まれています。影響を受けたパッケージをインストールすると、install.js が実行され、Windows 環境で node-gyp.dll マルウェアが起動します。", "risk": "インストール時にマルウェアが起動し、Windows システム上で不正なコードが実行される可能性があります。", "product": "eslint-config-prettier", "category": "other", "component": "package", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "affected": [ { "product": "eslint-config-prettier", "range": "8.10.1" }, { "product": "eslint-config-prettier", "range": "9.1.1" }, { "product": "eslint-config-prettier", "range": "10.1.6" }, { "product": "eslint-config-prettier", "range": "10.1.7" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54313", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-54313", "label": "CVE公式レコード" }, { "url": "https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise", "label": "CVE掲載の参考情報" }, { "url": "https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/prettier/eslint-config-prettier/issues/339", "label": "CVE掲載の参考情報" }, { "url": "https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions", "label": "CISAが示す関連情報" }, { "url": "https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=44609732", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=44608811", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/prettier/eslint-config-prettier/issues/339#issuecomment-3090304490", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54313", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-07-19T00:00:00.000Z", "modifiedAt": "2026-02-26T17:50:26.767Z", "fetchedAt": "2026-10-23T02:43:39.277Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "eslint-config-prettier", "vendor": "prettier", "versions": [ { "status": "affected", "version": "8.10.1", "versionType": "semver" }, { "status": "affected", "version": "9.1.1", "versionType": "semver" }, { "status": "affected", "version": "10.1.6", "versionType": "semver" }, { "status": "affected", "version": "10.1.7", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-54313", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json", "fetchedAt": "2026-10-23T02:43:39.277Z", "publishedAt": "2025-07-19T00:00:00.000Z", "modifiedAt": "2026-02-26T17:50:26.767Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "prettier", "product": "eslint-config-prettier", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.10.1", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "9.1.1", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "10.1.6", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "10.1.7", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-506", "lang": "en", "description": "CWE-506 Embedded Malicious Code", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://github.com/prettier/eslint-config-prettier/issues/339", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/2" }, { "url": "https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/3" }, { "url": "https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/4" }, { "url": "https://news.ycombinator.com/item?id=44609732", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/5" }, { "url": "https://news.ycombinator.com/item?id=44608811", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/6" }, { "url": "https://github.com/community-scripts/ProxmoxVE/discussions/6115", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.endorlabs.com/learn/cve-2025-54313-eslint-config-prettier-compromise----high-severity-but-windows-only", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54313", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"eslint-config-prettier\",\"vendor\":\"prettier\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.10.1\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"9.1.1\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"10.1.6\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"10.1.7\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-506\",\"description\":\"CWE-506 Embedded Malicious Code\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T17:50:26.767Z", "fetchedAt": "2026-10-23T02:43:39.277Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-01-22T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "eslint-config-prettierに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:13.668Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "42ace67135b30639f7e383b84ebc9bc7bbc2e0440c6e7693108ce427252ddd42", "sourceModifiedAt": "2026-02-26T17:50:26.767Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "eslint-config-prettier のバージョン 8.10.1、9.1.1、10.1.6、10.1.7 にはサプライチェーン攻撃用の悪意あるコードが埋め込まれています。影響を受けたパッケージをインストールすると、install.js が実行され、Windows 環境で node-gyp.dll マルウェアが起動します。", "risk": "インストール時にマルウェアが起動し、Windows システム上で不正なコードが実行される可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "eslint-config-prettier のバージョン 8.10.1、9.1.1、10.1.6、10.1.7 は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：prettier / eslint-config-prettier。影響ありとして記載：8.10.1。影響ありとして記載：9.1.1。影響ありとして記載：10.1.6。影響ありとして記載：10.1.7。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54313" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json" ], "evidenceIds": [ "E2" ] }, { "text": "「eslint-config-prettier」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-54313", "https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise", "https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/", "https://github.com/prettier/eslint-config-prettier/issues/339", "https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions", "https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise", "https://news.ycombinator.com/item?id=44609732", "https://news.ycombinator.com/item?id=44608811", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54313", "https://github.com/prettier/eslint-config-prettier/issues/339#issuecomment-3090304490", "https://nvd.nist.gov/vuln/detail/CVE-2025-54313" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-54313", "https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise", "https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/", "https://github.com/prettier/eslint-config-prettier/issues/339", "https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions", "https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise", "https://news.ycombinator.com/item?id=44609732", "https://news.ycombinator.com/item?id=44608811", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54313", "https://github.com/prettier/eslint-config-prettier/issues/339#issuecomment-3090304490", "https://nvd.nist.gov/vuln/detail/CVE-2025-54313" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-54313", "https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise", "https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/", "https://github.com/prettier/eslint-config-prettier/issues/339", "https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions", "https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise", "https://news.ycombinator.com/item?id=44609732", "https://news.ycombinator.com/item?id=44608811", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54313", "https://github.com/prettier/eslint-config-prettier/issues/339#issuecomment-3090304490", "https://nvd.nist.gov/vuln/detail/CVE-2025-54313" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54313", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-54313", "label": "CVE公式レコード" }, { "url": "https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise", "label": "CVE掲載の参考情報" }, { "url": "https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/prettier/eslint-config-prettier/issues/339", "label": "CVE掲載の参考情報" }, { "url": "https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions", "label": "CISAが示す関連情報" }, { "url": "https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=44609732", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=44608811", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/prettier/eslint-config-prettier/issues/339#issuecomment-3090304490", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54313", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54313.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"eslint-config-prettier\",\"vendor\":\"prettier\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.10.1\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"9.1.1\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"10.1.6\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"10.1.7\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54313", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-54313\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-54313（eslint-config-prettier）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・eslint-config-prettier のバージョン 8.10.1、9.1.1、10.1.6、10.1.7 は影響を受けます。\n・公式の対象表：prettier / eslint-config-prettier。影響ありとして記載：8.10.1。影響ありとして記載：9.1.1。影響ありとして記載：10.1.6。影響ありとして記載：10.1.7。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-54313", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:13.668Z", "lastSuccess": "2026-10-23T03:25:13.668Z", "sourceCheckedAt": "2026-10-23T02:43:39.277Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-68645", "aliases": [], "title": "n/a：脆弱性情報", "summary": "Zimbra Collaboration (ZCS) 10.0 と 10.1 の Webmail Classic UI にローカルファイルインクルージョン (LFI) の脆弱性があります。RestFilter サーブレットがユーザー提供のリクエストパラメータを適切に処理しないため、認証されていないリモート攻撃者が /h/rest エンドポイントに対して細工したリクエストを送ることで、内部のリクエストディスパッチを操作し、WebRoot ディレクトリ内の任意のファイルをインクルードできる可能性があります。", "risk": "WebRoot ディレクトリ内の任意のファイルがインクルードされる可能性がある。", "product": "Synacor Zimbra Collaboration Suite (ZCS)", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68645", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-68645", "label": "CVE公式レコード" }, { "url": "https://wiki.zimbra.com/wiki/Security_Center", "label": "CISAが示す関連情報" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68645", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-12-22T00:00:00.000Z", "modifiedAt": "2026-02-26T16:07:24.712Z", "fetchedAt": "2026-10-23T02:43:40.307Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "n/a", "product": "n/a", "versions": [ { "version": "n/a", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-68645", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json", "fetchedAt": "2026-10-23T02:43:40.307Z", "publishedAt": "2025-12-22T00:00:00.000Z", "modifiedAt": "2026-02-26T16:07:24.712Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://wiki.zimbra.com/wiki/Security_Center", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68645", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"text\",\"lang\":\"en\",\"description\":\"n/a\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T16:07:24.712Z", "fetchedAt": "2026-10-23T02:43:40.307Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-01-22T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:38:34.277Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "0a1d7dddc5ef574829c39c4bf75ce9495fb22dae23b5df9ae1d56888dd894c82", "sourceModifiedAt": "2026-02-26T16:07:24.712Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Zimbra Collaboration (ZCS) 10.0 と 10.1 の Webmail Classic UI にローカルファイルインクルージョン (LFI) の脆弱性があります。RestFilter サーブレットがユーザー提供のリクエストパラメータを適切に処理しないため、認証されていないリモート攻撃者が /h/rest エンドポイントに対して細工したリクエストを送ることで、内部のリクエストディスパッチを操作し、WebRoot ディレクトリ内の任意のファイルをインクルードできる可能性があります。", "risk": "WebRoot ディレクトリ内の任意のファイルがインクルードされる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Zimbra Collaboration Suite (ZCS) の Webmail Classic UI に影響がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json" ], "evidenceIds": [ "E1" ] }, { "text": "影響は ZCS バージョン 10.0 と 10.1 に限定される。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json" ], "evidenceIds": [ "E1" ] }, { "text": "問題は RestFilter サーブレットがユーザー提供のリクエストパラメータを不適切に処理することに起因する。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json" ], "evidenceIds": [ "E1" ] }, { "text": "認証されていないリモート攻撃者が /h/rest エンドポイントへリクエストを作成できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json" ], "evidenceIds": [ "E1" ] }, { "text": "これにより内部のリクエストディスパッチが操作され、WebRoot ディレクトリ内の任意のファイルがインクルードされ得る。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68645" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Synacor Zimbra Collaboration Suite (ZCS)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-68645", "https://wiki.zimbra.com/wiki/Security_Center", "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68645", "https://nvd.nist.gov/vuln/detail/CVE-2025-68645" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-68645", "https://wiki.zimbra.com/wiki/Security_Center", "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68645", "https://nvd.nist.gov/vuln/detail/CVE-2025-68645" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-68645", "https://wiki.zimbra.com/wiki/Security_Center", "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68645", "https://nvd.nist.gov/vuln/detail/CVE-2025-68645" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68645", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-68645", "label": "CVE公式レコード" }, { "url": "https://wiki.zimbra.com/wiki/Security_Center", "label": "CISAが示す関連情報" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68645", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68645.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68645", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-68645\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-68645（Synacor Zimbra Collaboration Suite (ZCS)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Zimbra Collaboration Suite (ZCS) の Webmail Classic UI に影響がある。\n・影響は ZCS バージョン 10.0 と 10.1 に限定される。\n・問題は RestFilter サーブレットがユーザー提供のリクエストパラメータを不適切に処理することに起因する。\n・認証されていないリモート攻撃者が /h/rest エンドポイントへリクエストを作成できる。\n・これにより内部のリクエストディスパッチが操作され、WebRoot ディレクトリ内の任意のファイルがインクルードされ得る。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-68645", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:38:34.277Z", "lastSuccess": "2026-10-23T03:38:34.277Z", "sourceCheckedAt": "2026-10-23T02:43:40.307Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-20045", "aliases": [], "title": "Cisco Unified Communications Manager / Cisco Unified Communications Manager IM and Presence Service / Cisco Unity Connection：コード実行", "summary": "Cisco Unified Communications Manager、Unified CM Session Management Edition、Unified CM IM & Presence Service、Cisco Unity Connection、Cisco Webex Calling Dedicated Instance において、HTTP リクエスト内のユーザー入力が適切に検証されないため、認証されていない遠隔の攻撃者がデバイスの OS 上で任意のコマンドを実行できる脆弱性があります。攻撃者はこの脆弱性を利用して、まずユーザー権限で OS にアクセスし、さらに特権昇格して root 権限を取得することが可能です。Cisco はこの脆弱性のスコアが High であるにもかかわらず、実際に root 権限への昇格が可能になる点から Critical と評価しています。", "risk": "攻撃者がデバイスの OS にユーザー権限でアクセスし、さらに root 権限へ昇格できるため、システム全体を支配される可能性があります。", "product": "Cisco Unified Communications Manager / Cisco Unified Communications Manager IM and Presence Service / Cisco Unity Connection", "category": "other", "component": "package", "severity": "high", "cvss": 8.2, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "affected": [ { "product": "Cisco Unified Communications Manager", "range": "12.5(1)SU2" }, { "product": "Cisco Unified Communications Manager", "range": "12.5(1)SU1" }, { "product": "Cisco Unified Communications Manager", "range": "12.5(1)" }, { "product": "Cisco Unified Communications Manager", "range": "12.5(1)SU3" }, { "product": "Cisco Unified Communications Manager", "range": "12.5(1)SU4" }, { "product": "Cisco Unified Communications Manager", "range": "14" }, { "product": "Cisco Unified Communications Manager", "range": "12.5(1)SU5" }, { "product": "Cisco Unified Communications Manager", "range": "14SU1" }, { "product": "Cisco Unified Communications Manager", "range": "12.5(1)SU6" }, { "product": "Cisco Unified Communications Manager", "range": "14SU2" }, { "product": "Cisco Unified Communications Manager", "range": "12.5(1)SU7" }, { "product": "Cisco Unified Communications Manager", "range": "12.5(1)SU7a" }, { "product": "Cisco Unified Communications Manager", "range": "14SU3" }, { "product": "Cisco Unified Communications Manager", "range": "12.5(1)SU8" }, { "product": "Cisco Unified Communications Manager", "range": "12.5(1)SU8a" }, { "product": "Cisco Unified Communications Manager", "range": "15" }, { "product": "Cisco Unified Communications Manager", "range": "15SU1" }, { "product": "Cisco Unified Communications Manager", "range": "14SU4" }, { "product": "Cisco Unified Communications Manager", "range": "14SU4a" }, { "product": "Cisco Unified Communications Manager", "range": "15SU1a" }, { "product": "Cisco Unified Communications Manager", "range": "12.5(1)SU9" }, { "product": "Cisco Unified Communications Manager", "range": "15SU2" }, { "product": "Cisco Unified Communications Manager", "range": "15.0.1.13010-1" }, { "product": "Cisco Unified Communications Manager", "range": "15.0.1.13011-1" }, { "product": "Cisco Unified Communications Manager", "range": "15.0.1.13012-1" }, { "product": "Cisco Unified Communications Manager", "range": "15.0.1.13013-1" }, { "product": "Cisco Unified Communications Manager", "range": "15.0.1.13014-1" }, { "product": "Cisco Unified Communications Manager", "range": "15.0.1.13015-1" }, { "product": "Cisco Unified Communications Manager", "range": "15.0.1.13016-1" }, { "product": "Cisco Unified Communications Manager", "range": "15.0.1.13017-1" }, { "product": "Cisco Unified Communications Manager", "range": "15SU3a" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "12.5(1)" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "12.5(1)SU1" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "12.5(1)SU2" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "12.5(1)SU3" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "12.5(1)SU4" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "14" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "12.5(1)SU5" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "14SU1" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "12.5(1)SU6" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "14SU2" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "14SU2a" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "12.5(1)SU7" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "14SU3" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "12.5(1)SU8" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "15" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "15SU1" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "14SU4" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "12.5(1)SU9" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "15SU2" }, { "product": "Cisco Unified Communications Manager IM and Presence Service", "range": "15SU3" }, { "product": "Cisco Unity Connection", "range": "12.5(1)" }, { "product": "Cisco Unity Connection", "range": "12.5(1)SU1" }, { "product": "Cisco Unity Connection", "range": "12.5(1)SU2" }, { "product": "Cisco Unity Connection", "range": "12.5(1)SU3" }, { "product": "Cisco Unity Connection", "range": "12.5(1)SU4" }, { "product": "Cisco Unity Connection", "range": "14" }, { "product": "Cisco Unity Connection", "range": "12.5(1)SU5" }, { "product": "Cisco Unity Connection", "range": "14SU1" }, { "product": "Cisco Unity Connection", "range": "12.5(1)SU6" }, { "product": "Cisco Unity Connection", "range": "14SU2" }, { "product": "Cisco Unity Connection", "range": "12.5(1)SU7" }, { "product": "Cisco Unity Connection", "range": "14SU3" }, { "product": "Cisco Unity Connection", "range": "12.5(1)SU8" }, { "product": "Cisco Unity Connection", "range": "14SU3a" }, { "product": "Cisco Unity Connection", "range": "12.5(1)SU8a" }, { "product": "Cisco Unity Connection", "range": "15" }, { "product": "Cisco Unity Connection", "range": "15SU1" }, { "product": "Cisco Unity Connection", "range": "14SU4" }, { "product": "Cisco Unity Connection", "range": "12.5(1)SU9" }, { "product": "Cisco Unity Connection", "range": "15SU2" }, { "product": "Cisco Unity Connection", "range": "15SU3" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20045", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20045", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20045", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-01-21T16:26:20.312Z", "modifiedAt": "2026-02-26T14:44:34.950Z", "fetchedAt": "2026-10-23T02:43:47.139Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. \r\n\r\nThis vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. \r\nNote: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.", "sourceTitle": "Cisco Unified Communications Products Remote Code Execution Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "Cisco Unified Communications Manager", "versions": [ { "version": "12.5(1)SU2", "status": "affected" }, { "version": "12.5(1)SU1", "status": "affected" }, { "version": "12.5(1)", "status": "affected" }, { "version": "12.5(1)SU3", "status": "affected" }, { "version": "12.5(1)SU4", "status": "affected" }, { "version": "14", "status": "affected" }, { "version": "12.5(1)SU5", "status": "affected" }, { "version": "14SU1", "status": "affected" }, { "version": "12.5(1)SU6", "status": "affected" }, { "version": "14SU2", "status": "affected" }, { "version": "12.5(1)SU7", "status": "affected" }, { "version": "12.5(1)SU7a", "status": "affected" }, { "version": "14SU3", "status": "affected" }, { "version": "12.5(1)SU8", "status": "affected" }, { "version": "12.5(1)SU8a", "status": "affected" }, { "version": "15", "status": "affected" }, { "version": "15SU1", "status": "affected" }, { "version": "14SU4", "status": "affected" }, { "version": "14SU4a", "status": "affected" }, { "version": "15SU1a", "status": "affected" }, { "version": "12.5(1)SU9", "status": "affected" }, { "version": "15SU2", "status": "affected" }, { "version": "15.0.1.13010-1", "status": "affected" }, { "version": "15.0.1.13011-1", "status": "affected" }, { "version": "15.0.1.13012-1", "status": "affected" }, { "version": "15.0.1.13013-1", "status": "affected" }, { "version": "15.0.1.13014-1", "status": "affected" }, { "version": "15.0.1.13015-1", "status": "affected" }, { "version": "15.0.1.13016-1", "status": "affected" }, { "version": "15.0.1.13017-1", "status": "affected" }, { "version": "15SU3a", "status": "affected" } ], "defaultStatus": "unknown" }, { "vendor": "Cisco", "product": "Cisco Unified Communications Manager IM and Presence Service", "versions": [ { "version": "12.5(1)", "status": "affected" }, { "version": "12.5(1)SU1", "status": "affected" }, { "version": "12.5(1)SU2", "status": "affected" }, { "version": "12.5(1)SU3", "status": "affected" }, { "version": "12.5(1)SU4", "status": "affected" }, { "version": "14", "status": "affected" }, { "version": "12.5(1)SU5", "status": "affected" }, { "version": "14SU1", "status": "affected" }, { "version": "12.5(1)SU6", "status": "affected" }, { "version": "14SU2", "status": "affected" }, { "version": "14SU2a", "status": "affected" }, { "version": "12.5(1)SU7", "status": "affected" }, { "version": "14SU3", "status": "affected" }, { "version": "12.5(1)SU8", "status": "affected" }, { "version": "15", "status": "affected" }, { "version": "15SU1", "status": "affected" }, { "version": "14SU4", "status": "affected" }, { "version": "12.5(1)SU9", "status": "affected" }, { "version": "15SU2", "status": "affected" }, { "version": "15SU3", "status": "affected" } ], "defaultStatus": "unknown" }, { "vendor": "Cisco", "product": "Cisco Unity Connection", "versions": [ { "version": "12.5(1)", "status": "affected" }, { "version": "12.5(1)SU1", "status": "affected" }, { "version": "12.5(1)SU2", "status": "affected" }, { "version": "12.5(1)SU3", "status": "affected" }, { "version": "12.5(1)SU4", "status": "affected" }, { "version": "14", "status": "affected" }, { "version": "12.5(1)SU5", "status": "affected" }, { "version": "14SU1", "status": "affected" }, { "version": "12.5(1)SU6", "status": "affected" }, { "version": "14SU2", "status": "affected" }, { "version": "12.5(1)SU7", "status": "affected" }, { "version": "14SU3", "status": "affected" }, { "version": "12.5(1)SU8", "status": "affected" }, { "version": "14SU3a", "status": "affected" }, { "version": "12.5(1)SU8a", "status": "affected" }, { "version": "15", "status": "affected" }, { "version": "15SU1", "status": "affected" }, { "version": "14SU4", "status": "affected" }, { "version": "12.5(1)SU9", "status": "affected" }, { "version": "15SU2", "status": "affected" }, { "version": "15SU3", "status": "affected" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-20045", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "fetchedAt": "2026-10-23T02:43:47.139Z", "publishedAt": "2026-01-21T16:26:20.312Z", "modifiedAt": "2026-02-26T14:44:34.950Z", "state": "published", "provider": "cisco", "title": "Cisco Unified Communications Products Remote Code Execution Vulnerability", "descriptions": [ { "lang": "en", "value": "A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. \r\n\r\nThis vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. \r\nNote: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Cisco", "product": "Cisco Unified Communications Manager", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.5(1)SU2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "12.5(1)SU1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "12.5(1)", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "12.5(1)SU3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "12.5(1)SU4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "14", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "12.5(1)SU5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "14SU1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "12.5(1)SU6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "14SU2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "12.5(1)SU7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "12.5(1)SU7a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "14SU3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "12.5(1)SU8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "12.5(1)SU8a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "15", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "15SU1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "14SU4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/18", "version": "14SU4a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/19", "version": "15SU1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/20", "version": "12.5(1)SU9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/21", "version": "15SU2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/22", "version": "15.0.1.13010-1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/23", "version": "15.0.1.13011-1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/24", "version": "15.0.1.13012-1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/25", "version": "15.0.1.13013-1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/26", "version": "15.0.1.13014-1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/27", "version": "15.0.1.13015-1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/28", "version": "15.0.1.13016-1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/29", "version": "15.0.1.13017-1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/30", "version": "15SU3a", "status": "affected" } ] }, { "vendor": "Cisco", "product": "Cisco Unified Communications Manager IM and Presence Service", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "12.5(1)", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "12.5(1)SU1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "12.5(1)SU2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "12.5(1)SU3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "12.5(1)SU4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": "14", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": "12.5(1)SU5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/7", "version": "14SU1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/8", "version": "12.5(1)SU6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/9", "version": "14SU2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/10", "version": "14SU2a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/11", "version": "12.5(1)SU7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/12", "version": "14SU3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/13", "version": "12.5(1)SU8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/14", "version": "15", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/15", "version": "15SU1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/16", "version": "14SU4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/17", "version": "12.5(1)SU9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/18", "version": "15SU2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/19", "version": "15SU3", "status": "affected" } ] }, { "vendor": "Cisco", "product": "Cisco Unity Connection", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "12.5(1)", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/1", "version": "12.5(1)SU1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/2", "version": "12.5(1)SU2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/3", "version": "12.5(1)SU3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/4", "version": "12.5(1)SU4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/5", "version": "14", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/6", "version": "12.5(1)SU5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/7", "version": "14SU1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/8", "version": "12.5(1)SU6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/9", "version": "14SU2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/10", "version": "12.5(1)SU7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/11", "version": "14SU3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/12", "version": "12.5(1)SU8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/13", "version": "14SU3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/14", "version": "12.5(1)SU8a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/15", "version": "15", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/16", "version": "15SU1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/17", "version": "14SU4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/18", "version": "12.5(1)SU9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/19", "version": "15SU2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/20", "version": "15SU3", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is aware of attempted exploitation of this vulnerability in the wild. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-94", "lang": "en", "description": "Improper Control of Generation of Code ('Code Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "baseScore": 8.2, "baseSeverity": "HIGH", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b", "label": "cisco-sa-voice-rce-mORhqY4b", "tags": [], "provider": "cisco", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20045", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Unified Communications Manager\",\"versions\":[{\"version\":\"12.5(1)SU2\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU1\",\"status\":\"affected\"},{\"version\":\"12.5(1)\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU3\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU4\",\"status\":\"affected\"},{\"version\":\"14\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU5\",\"status\":\"affected\"},{\"version\":\"14SU1\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU6\",\"status\":\"affected\"},{\"version\":\"14SU2\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU7\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU7a\",\"status\":\"affected\"},{\"version\":\"14SU3\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU8\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU8a\",\"status\":\"affected\"},{\"version\":\"15\",\"status\":\"affected\"},{\"version\":\"15SU1\",\"status\":\"affected\"},{\"version\":\"14SU4\",\"status\":\"affected\"},{\"version\":\"14SU4a\",\"status\":\"affected\"},{\"version\":\"15SU1a\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU9\",\"status\":\"affected\"},{\"version\":\"15SU2\",\"status\":\"affected\"},{\"version\":\"15.0.1.13010-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13011-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13012-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13013-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13014-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13015-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13016-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13017-1\",\"status\":\"affected\"},{\"version\":\"15SU3a\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Unified Communications Manager IM and Presence Service\",\"versions\":[{\"version\":\"12.5(1)\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU1\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU2\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU3\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU4\",\"status\":\"affected\"},{\"version\":\"14\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU5\",\"status\":\"affected\"},{\"version\":\"14SU1\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU6\",\"status\":\"affected\"},{\"version\":\"14SU2\",\"status\":\"affected\"},{\"version\":\"14SU2a\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU7\",\"status\":\"affected\"},{\"version\":\"14SU3\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU8\",\"status\":\"affected\"},{\"version\":\"15\",\"status\":\"affected\"},{\"version\":\"15SU1\",\"status\":\"affected\"},{\"version\":\"14SU4\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU9\",\"status\":\"affected\"},{\"version\":\"15SU2\",\"status\":\"affected\"},{\"version\":\"15SU3\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Unity Connection\",\"versions\":[{\"version\":\"12.5(1)\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU1\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU2\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU3\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU4\",\"status\":\"affected\"},{\"version\":\"14\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU5\",\"status\":\"affected\"},{\"version\":\"14SU1\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU6\",\"status\":\"affected\"},{\"version\":\"14SU2\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU7\",\"status\":\"affected\"},{\"version\":\"14SU3\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU8\",\"status\":\"affected\"},{\"version\":\"14SU3a\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU8a\",\"status\":\"affected\"},{\"version\":\"15\",\"status\":\"affected\"},{\"version\":\"15SU1\",\"status\":\"affected\"},{\"version\":\"14SU4\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU9\",\"status\":\"affected\"},{\"version\":\"15SU2\",\"status\":\"affected\"},{\"version\":\"15SU3\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. \r\n\r\nThis vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. \r\nNote: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "The Cisco PSIRT is aware of attempted exploitation of this vulnerability in the wild. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Improper Control of Generation of Code ('Code Injection')\",\"type\":\"cwe\",\"cweId\":\"CWE-94\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T14:44:34.950Z", "fetchedAt": "2026-10-23T02:43:47.139Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-01-21T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Cisco Unified Communications Manager / Cisco Unified Communications Manager IM and Presence Service / Cisco Unity Connectionにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:14.120Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "3a78b096dedb07a29117d51ce3f7acd342766a69575fc9e74b1fed202a318f1f", "sourceModifiedAt": "2026-02-26T14:44:34.950Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco Unified Communications Manager、Unified CM Session Management Edition、Unified CM IM & Presence Service、Cisco Unity Connection、Cisco Webex Calling Dedicated Instance において、HTTP リクエスト内のユーザー入力が適切に検証されないため、認証されていない遠隔の攻撃者がデバイスの OS 上で任意のコマンドを実行できる脆弱性があります。攻撃者はこの脆弱性を利用して、まずユーザー権限で OS にアクセスし、さらに特権昇格して root 権限を取得することが可能です。Cisco はこの脆弱性のスコアが High であるにもかかわらず、実際に root 権限への昇格が可能になる点から Critical と評価しています。", "risk": "攻撃者がデバイスの OS にユーザー権限でアクセスし、さらに root 権限へ昇格できるため、システム全体を支配される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Cisco Unified Communications Manager の Web ベース管理インターフェースが対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "Cisco Unified Communications Manager Session Management Edition の Web ベース管理インターフェースが対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "Cisco Unified Communications Manager IM & Presence Service の Web ベース管理インターフェースが対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "Cisco Unity Connection の Web ベース管理インターフェースが対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "Cisco Webex Calling Dedicated Instance の Web ベース管理インターフェースが対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Cisco / Cisco Unified Communications Manager。影響ありとして記載：12.5(1)SU2。影響ありとして記載：12.5(1)SU1。影響ありとして記載：12.5(1)。影響ありとして記載：12.5(1)SU3。影響ありとして記載：12.5(1)SU4。影響ありとして記載：14。影響ありとして記載：12.5(1)SU5。影響ありとして記載：14SU1。影響ありとして記載：12.5(1)SU6。影響ありとして記載：14SU2。影響ありとして記載：12.5(1)SU7。影響ありとして記載：12.5(1)SU7a。影響ありとして記載：14SU3。影響ありとして記載：12.5(1)SU8。影響ありとして記載：12.5(1)SU8a。影響ありとして記載：15。影響ありとして記載：15SU1。影響ありとして記載：14SU4。影響ありとして記載：14SU4a。影響ありとして記載：15SU1a。影響ありとして記載：12.5(1)SU9。影響ありとして記載：15SU2。影響ありとして記載：15.0.1.13010-1。影響ありとして記載：15.0.1.13011-1。影響ありとして記載：15.0.1.13012-1。影響ありとして記載：15.0.1.13013-1。影響ありとして記載：15.0.1.13014-1。影響ありとして記載：15.0.1.13015-1。影響ありとして記載：15.0.1.13016-1。影響ありとして記載：15.0.1.13017-1。影響ありとして記載：15SU3a。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Cisco / Cisco Unified Communications Manager IM and Presence Service。影響ありとして記載：12.5(1)。影響ありとして記載：12.5(1)SU1。影響ありとして記載：12.5(1)SU2。影響ありとして記載：12.5(1)SU3。影響ありとして記載：12.5(1)SU4。影響ありとして記載：14。影響ありとして記載：12.5(1)SU5。影響ありとして記載：14SU1。影響ありとして記載：12.5(1)SU6。影響ありとして記載：14SU2。影響ありとして記載：14SU2a。影響ありとして記載：12.5(1)SU7。影響ありとして記載：14SU3。影響ありとして記載：12.5(1)SU8。影響ありとして記載：15。影響ありとして記載：15SU1。影響ありとして記載：14SU4。影響ありとして記載：12.5(1)SU9。影響ありとして記載：15SU2。影響ありとして記載：15SU3。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Cisco / Cisco Unity Connection。影響ありとして記載：12.5(1)。影響ありとして記載：12.5(1)SU1。影響ありとして記載：12.5(1)SU2。影響ありとして記載：12.5(1)SU3。影響ありとして記載：12.5(1)SU4。影響ありとして記載：14。影響ありとして記載：12.5(1)SU5。影響ありとして記載：14SU1。影響ありとして記載：12.5(1)SU6。影響ありとして記載：14SU2。影響ありとして記載：12.5(1)SU7。影響ありとして記載：14SU3。影響ありとして記載：12.5(1)SU8。影響ありとして記載：14SU3a。影響ありとして記載：12.5(1)SU8a。影響ありとして記載：15。影響ありとして記載：15SU1。影響ありとして記載：14SU4。影響ありとして記載：12.5(1)SU9。影響ありとして記載：15SU2。影響ありとして記載：15SU3。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20045" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Cisco Unified Communications Manager / Cisco Unified Communications Manager IM and Presence Service / Cisco Unity Connection」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20045", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20045", "https://nvd.nist.gov/vuln/detail/CVE-2026-20045" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-20045", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20045", "https://nvd.nist.gov/vuln/detail/CVE-2026-20045" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20045", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20045", "https://nvd.nist.gov/vuln/detail/CVE-2026-20045" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20045", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20045", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20045", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. \r\n\r\nThis vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. \r\nNote: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "sourceField": "/containers/cna/title", "excerpt": "Cisco Unified Communications Products Remote Code Execution Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Unified Communications Manager\",\"versions\":[{\"version\":\"12.5(1)SU2\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU1\",\"status\":\"affected\"},{\"version\":\"12.5(1)\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU3\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU4\",\"status\":\"affected\"},{\"version\":\"14\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU5\",\"status\":\"affected\"},{\"version\":\"14SU1\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU6\",\"status\":\"affected\"},{\"version\":\"14SU2\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU7\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU7a\",\"status\":\"affected\"},{\"version\":\"14SU3\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU8\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU8a\",\"status\":\"affected\"},{\"version\":\"15\",\"status\":\"affected\"},{\"version\":\"15SU1\",\"status\":\"affected\"},{\"version\":\"14SU4\",\"status\":\"affected\"},{\"version\":\"14SU4a\",\"status\":\"affected\"},{\"version\":\"15SU1a\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU9\",\"status\":\"affected\"},{\"version\":\"15SU2\",\"status\":\"affected\"},{\"version\":\"15.0.1.13010-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13011-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13012-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13013-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13014-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13015-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13016-1\",\"status\":\"affected\"},{\"version\":\"15.0.1.13017-1\",\"status\":\"affected\"},{\"version\":\"15SU3a\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Unified Communications Manager IM and Presence Service\",\"versions\":[{\"version\":\"12.5(1)\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU1\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU2\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU3\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU4\",\"status\":\"affected\"},{\"version\":\"14\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU5\",\"status\":\"affected\"},{\"version\":\"14SU1\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU6\",\"status\":\"affected\"},{\"version\":\"14SU2\",\"status\":\"affected\"},{\"version\":\"14SU2a\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU7\",\"status\":\"affected\"},{\"version\":\"14SU3\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU8\",\"status\":\"affected\"},{\"version\":\"15\",\"status\":\"affected\"},{\"version\":\"15SU1\",\"status\":\"affected\"},{\"version\":\"14SU4\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU9\",\"status\":\"affected\"},{\"version\":\"15SU2\",\"status\":\"affected\"},{\"version\":\"15SU3\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20045.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Unity Connection\",\"versions\":[{\"version\":\"12.5(1)\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU1\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU2\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU3\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU4\",\"status\":\"affected\"},{\"version\":\"14\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU5\",\"status\":\"affected\"},{\"version\":\"14SU1\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU6\",\"status\":\"affected\"},{\"version\":\"14SU2\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU7\",\"status\":\"affected\"},{\"version\":\"14SU3\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU8\",\"status\":\"affected\"},{\"version\":\"14SU3a\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU8a\",\"status\":\"affected\"},{\"version\":\"15\",\"status\":\"affected\"},{\"version\":\"15SU1\",\"status\":\"affected\"},{\"version\":\"14SU4\",\"status\":\"affected\"},{\"version\":\"12.5(1)SU9\",\"status\":\"affected\"},{\"version\":\"15SU2\",\"status\":\"affected\"},{\"version\":\"15SU3\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20045", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-20045\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-20045（Cisco Unified Communications Manager / Cisco Unified Communications Manager IM and Presence Service / Cisco Unity Connection）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Cisco Unified Communications Manager の Web ベース管理インターフェースが対象です。\n・Cisco Unified Communications Manager Session Management Edition の Web ベース管理インターフェースが対象です。\n・Cisco Unified Communications Manager IM & Presence Service の Web ベース管理インターフェースが対象です。\n・Cisco Unity Connection の Web ベース管理インターフェースが対象です。\n・Cisco Webex Calling Dedicated Instance の Web ベース管理インターフェースが対象です。\n・公式の対象表：Cisco / Cisco Unified Communications Manager。影響ありとして記載：12.5(1)SU2。影響ありとして記載：12.5(1)SU1。影響ありとして記載：12.5(1)。影響ありとして記載：12.5(1)SU3。影響ありとして記載：12.5(1)SU4。影響ありとして記載：14。影響ありとして記載：12.5(1)SU5。影響ありとして記載：14SU1。影響ありとして記載：12.5(1)SU6。影響ありとして記載：14SU2。影響ありとして記載：12.5(1)SU7。影響ありとして記載：12.5(1)SU7a。影響ありとして記載：14SU3。影響ありとして記載：12.5(1)SU8。影響ありとして記載：12.5(1)SU8a。影響ありとして記載：15。影響ありとして記載：15SU1。影響ありとして記載：14SU4。影響ありとして記載：14SU4a。影響ありとして記載：15SU1a。影響ありとして記載：12.5(1)SU9。影響ありとして記載：15SU2。影響ありとして記載：15.0.1.13010-1。影響ありとして記載：15.0.1.13011-1。影響ありとして記載：15.0.1.13012-1。影響ありとして記載：15.0.1.13013-1。影響ありとして記載：15.0.1.13014-1。影響ありとして記載：15.0.1.13015-1。影響ありとして記載：15.0.1.13016-1。影響ありとして記載：15.0.1.13017-1。影響ありとして記載：15SU3a。個別に記されていない版の影響は、原資料でも未確定です。\n・公式の対象表：Cisco / Cisco Unified Communications Manager IM and Presence Service。影響ありとして記載：12.5(1)。影響ありとして記載：12.5(1)SU1。影響ありとして記載：12.5(1)SU2。影響ありとして記載：12.5(1)SU3。影響ありとして記載：12.5(1)SU4。影響ありとして記載：14。影響ありとして記載：12.5(1)SU5。影響ありとして記載：14SU1。影響ありとして記載：12.5(1)SU6。影響ありとして記載：14SU2。影響ありとして記載：14SU2a。影響ありとして記載：12.5(1)SU7。影響ありとして記載：14SU3。影響ありとして記載：12.5(1)SU8。影響ありとして記載：15。影響ありとして記載：15SU1。影響ありとして記載：14SU4。影響ありとして記載：12.5(1)SU9。影響ありとして記載：15SU2。影響ありとして記載：15SU3。個別に記されていない版の影響は、原資料でも未確定です。\n・公式の対象表：Cisco / Cisco Unity Connection。影響ありとして記載：12.5(1)。影響ありとして記載：12.5(1)SU1。影響ありとして記載：12.5(1)SU2。影響ありとして記載：12.5(1)SU3。影響ありとして記載：12.5(1)SU4。影響ありとして記載：14。影響ありとして記載：12.5(1)SU5。影響ありとして記載：14SU1。影響ありとして記載：12.5(1)SU6。影響ありとして記載：14SU2。影響ありとして記載：12.5(1)SU7。影響ありとして記載：14SU3。影響ありとして記載：12.5(1)SU8。影響ありとして記載：14SU3a。影響ありとして記載：12.5(1)SU8a。影響ありとして記載：15。影響ありとして記載：15SU1。影響ありとして記載：14SU4。影響ありとして記載：12.5(1)SU9。影響ありとして記載：15SU2。影響ありとして記載：15SU3。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-20045", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:14.120Z", "lastSuccess": "2026-10-23T03:25:14.120Z", "sourceCheckedAt": "2026-10-23T02:43:47.139Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-20805", "aliases": [], "title": "Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 23H2 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows Server 2012 / Windows Server 2012 ：情報の漏えい", "summary": "Desktop Windows Manager において機密情報が未承認のアクターに露出し、認可された攻撃者がローカルで情報を開示できる。", "risk": "機密情報が漏洩する可能性がある。", "product": "Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 23H2 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows Server 2012 / Windows Server 2012 ", "category": "windows", "component": "package", "severity": "medium", "cvss": 5.5, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.8783（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.8276（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19044.0 / < 10.0.19044.6809（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.6809（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.6491（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.6491（環境: x64-based Systems）" }, { "product": "Windows 11 Version 24H2", "range": ">= 10.0.26100.0 / < 10.0.26100.7623（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 Version 25H2", "range": ">= 10.0.26200.0 / < 10.0.26200.7623（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.25868（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.25868（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.22968（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.22968（環境: x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.8783（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.8783（環境: x64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.8276（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.8276（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.4648（環境: x64-based Systems）" }, { "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "range": ">= 10.0.25398.0 / < 10.0.25398.2092（環境: x64-based Systems）" }, { "product": "Windows Server 2025", "range": ">= 10.0.26100.0 / < 10.0.26100.32230（環境: x64-based Systems）" }, { "product": "Windows Server 2025 (Server Core installation)", "range": ">= 10.0.26100.0 / < 10.0.26100.32230（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20805", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20805", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805", "label": "Desktop Window Manager Information Disclosure Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-20805", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20805", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2026-01-13T17:56:08.339Z", "modifiedAt": "2026-07-30T20:46:25.010Z", "fetchedAt": "2026-10-23T02:43:47.551Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Desktop Window Manager Information Disclosure Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.8783", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.8276", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19044.0", "lessThan": "10.0.19044.6809", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.6809", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 23H2", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.6491", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.6491", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.7623", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 25H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.26200.0", "lessThan": "10.0.26200.7623", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22968", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22968", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.8783", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.8783", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.8276", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.8276", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.4648", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.25398.0", "lessThan": "10.0.25398.2092", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.32230", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.32230", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-20805", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "fetchedAt": "2026-10-23T02:43:47.551Z", "publishedAt": "2026-01-13T17:56:08.339Z", "modifiedAt": "2026-07-30T20:46:25.010Z", "state": "published", "provider": "microsoft", "title": "Desktop Window Manager Information Disclosure Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.8783", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/1", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.8276", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.19044.0", "lessThan": "10.0.19044.6809", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/3", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.6809", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 23H2", "sourcePath": "/containers/cna/affected/4", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.6491", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "sourcePath": "/containers/cna/affected/5", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.6491", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "sourcePath": "/containers/cna/affected/6", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.7623", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 25H2", "sourcePath": "/containers/cna/affected/7", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "10.0.26200.0", "lessThan": "10.0.26200.7623", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/8", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/9", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/10", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22968", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/11", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22968", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/12", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/12/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.8783", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/13", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/13/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.8783", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/14", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/14/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.8276", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/15", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/15/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.8276", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/16", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/16/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.4648", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "sourcePath": "/containers/cna/affected/17", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/17/versions/0", "version": "10.0.25398.0", "lessThan": "10.0.25398.2092", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "sourcePath": "/containers/cna/affected/18", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/18/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.32230", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "sourcePath": "/containers/cna/affected/19", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/19/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.32230", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-200", "lang": "en-US", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C", "baseScore": 5.5, "baseSeverity": "MEDIUM", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805", "label": "Desktop Window Manager Information Disclosure Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20805", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8783\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8276\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.6809\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.6809\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 23H2\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.6491\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.6491\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.7623\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 25H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26200.0\",\"lessThan\":\"10.0.26200.7623\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22968\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22968\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/12", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8783\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/13", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8783\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/14", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8276\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/15", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8276\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/16", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.4648\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/17", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.2092\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/18", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.32230\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/affected/19", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.32230\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-200\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":5.5,\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-30T20:46:25.010Z", "fetchedAt": "2026-10-23T02:43:47.551Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-01-13T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 23H2 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows Server 2012 / Windows Server 2012 に情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:14.882Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "342796a2e34bfed7405fd3be7fce382d4d3367a39b80ad2b6f160696b953eb76", "sourceModifiedAt": "2026-07-30T20:46:25.010Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Desktop Windows Manager において機密情報が未承認のアクターに露出し、認可された攻撃者がローカルで情報を開示できる。", "risk": "機密情報が漏洩する可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Windows 10 Version 1607 の 32-bit および x64 系統で、バージョン 10.0.14393.0 以上 10.0.14393.8783 未満は影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Windows 10 Version 1809 の 32-bit および x64 系統で、バージョン 10.0.17763.0 以上 10.0.17763.8276 未満は影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Windows 10 Version 21H2 の 32-bit、ARM64、x64 系統で、バージョン 10.0.19044.0 以上 10.0.19044.6809 未満は影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "Windows 10 Version 22H2 の 32-bit、ARM64、x64 系統で、バージョン 10.0.19045.0 以上 10.0.19045.6809 未満は影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "Windows 11 version 23H2 の ARM64 系統で、バージョン 10.0.22631.0 以上 10.0.22631.6491 未満は影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E7", "E2" ] }, { "text": "Windows 11 Version 23H2 の x64 系統で、バージョン 10.0.22631.0 以上 10.0.22631.6491 未満は影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E8", "E2" ] }, { "text": "Windows 11 Version 24H2 の ARM64 および x64 系統で、バージョン 10.0.26100.0 以上 10.0.26100.7623 未満は影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E9", "E2" ] }, { "text": "Windows 11 Version 25H2 の ARM64 および x64 系統で、バージョン 10.0.26200.0 以上 10.0.26200.7623 未満は影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E10", "E2" ] }, { "text": "Windows Server 2012 の x64 系統で、バージョン 6.2.9200.0 以上 6.2.9200.25868 未満は影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E11", "E2" ] }, { "text": "Windows Server 2012 (Server Core インストール) の x64 系統で、バージョン 6.2.9200.0 以上 6.2.9200.25868 未満は影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E12", "E2" ] }, { "text": "Windows Server 2012 R2 の x64 系統で、バージョン 6.3.9600.0 以上 6.3.9600.22968 未満は影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E13", "E2" ] }, { "text": "Windows Server 2012 R2 (Server Core インストール) の x64 系統で、バージョン 6.3.9600.0 以上 6.3.9600.22968 未満は影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E14", "E2" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.8783未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.8276未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.6809未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.6809未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.6491未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.6491未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.7623未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 25H2。影響ありとして記載：10.0.26200.0以上、10.0.26200.7623未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25868未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25868未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22968未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22968未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E14" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.8783未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E15" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.8783未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E16" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.8276未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E17" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.8276未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E18" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.4648未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E19" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.2092未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E20" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.32230未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E21" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.32230未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E22" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20805" ], "evidenceIds": [ "E23" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E3" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2026-20805", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20805", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-20805", "https://nvd.nist.gov/vuln/detail/CVE-2026-20805" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json" ], "evidenceIds": [ "E3" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20805", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20805", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805", "label": "Desktop Window Manager Information Disclosure Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-20805", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20805", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/title", "excerpt": "Desktop Window Manager Information Disclosure Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8783\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8276\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.6809\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.6809\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 23H2\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.6491\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.6491\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.7623\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 25H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26200.0\",\"lessThan\":\"10.0.26200.7623\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22968\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22968\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/12", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8783\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/13", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8783\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/14", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8276\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/15", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8276\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/16", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.4648\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/17", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.2092\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/18", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.32230\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20805.json", "sourceField": "/containers/cna/affected/19", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.32230\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E23", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20805", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-20805\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-20805（Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 23H2 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows Server 2012 / Windows Server 2012 ）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Windows 10 Version 1607 の 32-bit および x64 系統で、バージョン 10.0.14393.0 以上 10.0.14393.8783 未満は影響を受ける。\n・Windows 10 Version 1809 の 32-bit および x64 系統で、バージョン 10.0.17763.0 以上 10.0.17763.8276 未満は影響を受ける。\n・Windows 10 Version 21H2 の 32-bit、ARM64、x64 系統で、バージョン 10.0.19044.0 以上 10.0.19044.6809 未満は影響を受ける。\n・Windows 10 Version 22H2 の 32-bit、ARM64、x64 系統で、バージョン 10.0.19045.0 以上 10.0.19045.6809 未満は影響を受ける。\n・Windows 11 version 23H2 の ARM64 系統で、バージョン 10.0.22631.0 以上 10.0.22631.6491 未満は影響を受ける。\n・Windows 11 Version 23H2 の x64 系統で、バージョン 10.0.22631.0 以上 10.0.22631.6491 未満は影響を受ける。\n・Windows 11 Version 24H2 の ARM64 および x64 系統で、バージョン 10.0.26100.0 以上 10.0.26100.7623 未満は影響を受ける。\n・Windows 11 Version 25H2 の ARM64 および x64 系統で、バージョン 10.0.26200.0 以上 10.0.26200.7623 未満は影響を受ける。\n・Windows Server 2012 の x64 系統で、バージョン 6.2.9200.0 以上 6.2.9200.25868 未満は影響を受ける。\n・Windows Server 2012 (Server Core インストール) の x64 系統で、バージョン 6.2.9200.0 以上 6.2.9200.25868 未満は影響を受ける。\n・Windows Server 2012 R2 の x64 系統で、バージョン 6.3.9600.0 以上 6.3.9600.22968 未満は影響を受ける。\n・Windows Server 2012 R2 (Server Core インストール) の x64 系統で、バージョン 6.3.9600.0 以上 6.3.9600.22968 未満は影響を受ける。\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.8783未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.8276未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.6809未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.6809未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.6491未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.6491未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.7623未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 25H2。影響ありとして記載：10.0.26200.0以上、10.0.26200.7623未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25868未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25868未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22968未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22968未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.8783未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.8783未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.8276未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.8276未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.4648未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.2092未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.32230未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.32230未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-20805", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:14.882Z", "lastSuccess": "2026-10-23T03:25:14.882Z", "sourceCheckedAt": "2026-10-23T02:43:47.551Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-8110", "aliases": [], "title": "Gogs：脆弱性情報", "summary": "Gogs のファイル更新 API でシンボリックリンクの処理が不適切で、ローカルでコードが実行される可能性があります。", "risk": "攻撃者がローカルで任意のコードを実行できる可能性があります。", "product": "Gogs", "category": "other", "component": "package", "severity": "high", "cvss": 8.7, "cvssVersion": "4.0", "cvssSource": "Wiz", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/R:U/V:C", "affected": [ { "product": "Gogs", "range": "<= 0.13.3（環境: Linux / Windows）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json", "label": "CVE：Wiz" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-8110", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-8110", "label": "CVE公式レコード" }, { "url": "http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8110", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-12-10T13:23:46.777Z", "modifiedAt": "2026-02-26T16:21:06.106Z", "fetchedAt": "2026-10-23T02:43:40.383Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.", "sourceTitle": "File overwrite in file update API in Gogs", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "packageName": "Gogs", "platforms": [ "Linux", "Windows" ], "product": "Gogs", "repo": "https://github.com/gogs/gogs", "vendor": "Gogs", "versions": [ { "lessThanOrEqual": "0.13.3", "status": "affected", "version": "0", "versionType": "git" } ] } ], "configurationNotes": "対象環境・機能: Linux / Windows。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-8110", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json", "fetchedAt": "2026-10-23T02:43:40.383Z", "publishedAt": "2025-12-10T13:23:46.777Z", "modifiedAt": "2026-02-26T16:21:06.106Z", "state": "published", "provider": "Wiz", "title": "File overwrite in file update API in Gogs", "descriptions": [ { "lang": "en", "value": "Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Gogs", "product": "Gogs", "sourcePath": "/containers/cna/affected/0", "packageName": "Gogs", "repo": "https://github.com/gogs/gogs", "defaultStatus": "unaffected", "platforms": [ "Linux", "Windows" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "0.13.3", "versionType": "git", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/R:U/V:C", "baseScore": 8.7, "baseSeverity": "HIGH", "provider": "Wiz", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit", "label": "Wiz", "tags": [], "provider": "Wiz", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/gogs/gogs/pull/8078", "label": "CISA-ADP", "tags": [ "issue-tracking" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6", "label": "CISA-ADP", "tags": [ "patch" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://www.openwall.com/lists/oss-security/2025/12/11/3", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "http://www.openwall.com/lists/oss-security/2025/12/11/4", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/17/4", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/18/1", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/3" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/18/2", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/4" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"packageName\":\"Gogs\",\"platforms\":[\"Linux\",\"Windows\"],\"product\":\"Gogs\",\"repo\":\"https://github.com/gogs/gogs\",\"vendor\":\"Gogs\",\"versions\":[{\"lessThanOrEqual\":\"0.13.3\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"git\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-22\",\"description\":\"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"YES\",\"Recovery\":\"USER\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"attackVector\":\"NETWORK\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"exploitMaturity\":\"ATTACKED\",\"privilegesRequired\":\"LOW\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"valueDensity\":\"CONCENTRATED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/R:U/V:C\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"HIGH\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T16:21:06.106Z", "fetchedAt": "2026-10-23T02:43:40.383Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-01-12T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Gogsに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:15.897Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a04116856de4c6ca394709bedfab5e643676a10a58db2e2ac0ed826a73a97a02", "sourceModifiedAt": "2026-02-26T16:21:06.106Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Gogs のファイル更新 API でシンボリックリンクの処理が不適切で、ローカルでコードが実行される可能性があります。", "risk": "攻撃者がローカルで任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "Linux および Windows 上の Gogs のバージョン 0.13.3 以下が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "公式の対象表：Gogs / Gogs。影響ありとして記載：0.13.3以下の版。対象の環境：Linux、Windows", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-8110" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Gogs」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-8110", "http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-8110", "https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6", "https://nvd.nist.gov/vuln/detail/CVE-2025-8110" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-8110", "http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-8110", "https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6", "https://nvd.nist.gov/vuln/detail/CVE-2025-8110" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-8110", "http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-8110", "https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6", "https://nvd.nist.gov/vuln/detail/CVE-2025-8110" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json", "label": "CVE：Wiz" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-8110", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-8110", "label": "CVE公式レコード" }, { "url": "http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8110", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json", "sourceField": "/containers/cna/title", "excerpt": "File overwrite in file update API in Gogs", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8110.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"packageName\":\"Gogs\",\"platforms\":[\"Linux\",\"Windows\"],\"product\":\"Gogs\",\"repo\":\"https://github.com/gogs/gogs\",\"vendor\":\"Gogs\",\"versions\":[{\"lessThanOrEqual\":\"0.13.3\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"git\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-8110", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-8110\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-8110（Gogs）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Linux および Windows 上の Gogs のバージョン 0.13.3 以下が影響を受けます。\n・公式の対象表：Gogs / Gogs。影響ありとして記載：0.13.3以下の版。対象の環境：Linux、Windows\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-8110", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:15.897Z", "lastSuccess": "2026-10-23T03:25:15.897Z", "sourceCheckedAt": "2026-10-23T02:43:40.383Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2009-0556", "aliases": [], "title": "n/a：コード実行", "summary": "Microsoft Office PowerPoint 2000 SP3、2002 SP3、2003 SP3、そして Microsoft Office 2004 for Mac の PowerPoint において、OutlineTextRefAtom に無効なインデックス値が含まれた PowerPoint ファイルを開くと、メモリ破壊が発生し、リモートの攻撃者が任意のコードを実行できる脆弱性があります。", "risk": "攻撃者は対象のコンピュータ上で任意のコードを実行させられる可能性があります。", "product": "Microsoft Office", "category": "windows", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "microsoft", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-0556", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2009-0556", "label": "CVE公式レコード" }, { "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-019", "label": "CVE掲載の参考情報" }, { "url": "http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx", "label": "CVE掲載の参考情報" }, { "url": "http://www.vupen.com/english/advisories/2009/1290", "label": "ADV-2009-1290" }, { "url": "http://osvdb.org/53182", "label": "53182" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017", "label": "MS09-017" }, { "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49632", "label": "powerpoint-unspecified-code-execution(49632)" }, { "url": "http://www.securityfocus.com/bid/34351", "label": "34351" }, { "url": "http://www.vupen.com/english/advisories/2009/0915", "label": "ADV-2009-0915" }, { "url": "http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx", "label": "CVE掲載の参考情報" }, { "url": "http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0556", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2009-04-03T18:00:00.000Z", "modifiedAt": "2026-01-08T04:55:23.788Z", "fetchedAt": "2026-10-23T02:42:53.661Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka \"Memory Corruption Vulnerability.\"", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2009-0556", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json", "fetchedAt": "2026-10-23T02:42:53.661Z", "publishedAt": "2009-04-03T18:00:00.000Z", "modifiedAt": "2026-01-08T04:55:23.788Z", "state": "published", "provider": "microsoft", "title": "", "descriptions": [ { "lang": "en", "value": "Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka \"Memory Corruption Vulnerability.\"", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-019", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://www.vupen.com/english/advisories/2009/1290", "label": "ADV-2009-1290", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://osvdb.org/53182", "label": "53182", "tags": [ "vdb-entry", "x_refsource_OSVDB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017", "label": "MS09-017", "tags": [ "vendor-advisory", "x_refsource_MS", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49632", "label": "powerpoint-unspecified-code-execution(49632)", "tags": [ "vdb-entry", "x_refsource_XF", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "http://www.securityfocus.com/bid/34351", "label": "34351", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "http://www.vupen.com/english/advisories/2009/0915", "label": "ADV-2009-0915", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6279", "label": "oval:org.mitre.oval:def:6279", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/10" }, { "url": "http://secunia.com/advisories/34572", "label": "34572", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/11" }, { "url": "http://www.securitytracker.com/id?1021967", "label": "1021967", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/12" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA09-132A.html", "label": "TA09-132A", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/13" }, { "url": "http://www.microsoft.com/technet/security/advisory/969136.mspx", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/14" }, { "url": "http://www.kb.cert.org/vuls/id/627331", "label": "VU#627331", "tags": [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/15" }, { "url": "http://www.securityfocus.com/archive/1/503453/100/0/threaded", "label": "20090512 ZDI-09-019: Microsoft Office PowerPoint OutlineTextRefAtom Parsing Memory Corruption Vulnerability", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/16" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6204", "label": "oval:org.mitre.oval:def:6204", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/17" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0556", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka \"Memory Corruption Vulnerability.\"", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-01-08T04:55:23.788Z", "fetchedAt": "2026-10-23T02:42:53.661Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-01-07T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:16.753Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "9f1615b77feb02ea6847edd8844dece77dec6761f1be8046e4a4bec35cc3a9f6", "sourceModifiedAt": "2026-01-08T04:55:23.788Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Office PowerPoint 2000 SP3、2002 SP3、2003 SP3、そして Microsoft Office 2004 for Mac の PowerPoint において、OutlineTextRefAtom に無効なインデックス値が含まれた PowerPoint ファイルを開くと、メモリ破壊が発生し、リモートの攻撃者が任意のコードを実行できる脆弱性があります。", "risk": "攻撃者は対象のコンピュータ上で任意のコードを実行させられる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受けるのは PowerPoint 2000 SP3、PowerPoint 2002 SP3、PowerPoint 2003 SP3、そして Microsoft Office 2004 for Mac に含まれる PowerPoint です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-0556" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Microsoft Office」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2009-0556", "http://www.zerodayinitiative.com/advisories/ZDI-09-019", "http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx", "http://www.vupen.com/english/advisories/2009/1290", "http://osvdb.org/53182", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017", "https://exchange.xforce.ibmcloud.com/vulnerabilities/49632", "http://www.securityfocus.com/bid/34351", "http://www.vupen.com/english/advisories/2009/0915", "http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx", "http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-0556", "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017", "https://nvd.nist.gov/vuln/detail/CVE-2009-0556" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2009-0556", "http://www.zerodayinitiative.com/advisories/ZDI-09-019", "http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx", "http://www.vupen.com/english/advisories/2009/1290", "http://osvdb.org/53182", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017", "https://exchange.xforce.ibmcloud.com/vulnerabilities/49632", "http://www.securityfocus.com/bid/34351", "http://www.vupen.com/english/advisories/2009/0915", "http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx", "http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-0556", "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017", "https://nvd.nist.gov/vuln/detail/CVE-2009-0556" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2009-0556", "http://www.zerodayinitiative.com/advisories/ZDI-09-019", "http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx", "http://www.vupen.com/english/advisories/2009/1290", "http://osvdb.org/53182", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017", "https://exchange.xforce.ibmcloud.com/vulnerabilities/49632", "http://www.securityfocus.com/bid/34351", "http://www.vupen.com/english/advisories/2009/0915", "http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx", "http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-0556", "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017", "https://nvd.nist.gov/vuln/detail/CVE-2009-0556" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-0556", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2009-0556", "label": "CVE公式レコード" }, { "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-019", "label": "CVE掲載の参考情報" }, { "url": "http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx", "label": "CVE掲載の参考情報" }, { "url": "http://www.vupen.com/english/advisories/2009/1290", "label": "ADV-2009-1290" }, { "url": "http://osvdb.org/53182", "label": "53182" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017", "label": "MS09-017" }, { "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49632", "label": "powerpoint-unspecified-code-execution(49632)" }, { "url": "http://www.securityfocus.com/bid/34351", "label": "34351" }, { "url": "http://www.vupen.com/english/advisories/2009/0915", "label": "ADV-2009-0915" }, { "url": "http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx", "label": "CVE掲載の参考情報" }, { "url": "http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0556", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka \"Memory Corruption Vulnerability.\"", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/0xxx/CVE-2009-0556.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-0556", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2009-0556\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2009-0556（Microsoft Office）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるのは PowerPoint 2000 SP3、PowerPoint 2002 SP3、PowerPoint 2003 SP3、そして Microsoft Office 2004 for Mac に含まれる PowerPoint です。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2009-0556", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:16.753Z", "lastSuccess": "2026-10-23T03:25:16.753Z", "sourceCheckedAt": "2026-10-23T02:42:53.661Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-37164", "aliases": [], "title": "HPE OneView：コード実行", "summary": "HPE OneView にリモートコード実行の問題が存在します。", "risk": "CISA はこの脆弱性が実際に悪用されたと報告しています。", "product": "HPE OneView", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "hpe", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "HPE OneView", "range": "< 11.00" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/37xxx/CVE-2025-37164.json", "label": "CVE：hpe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-37164", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-37164", "label": "CVE公式レコード" }, { "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37164", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-12-16T16:30:34.524Z", "modifiedAt": "2026-02-26T16:07:33.179Z", "fetchedAt": "2026-10-23T02:43:38.018Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A remote code execution issue exists in HPE OneView.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "HPE OneView", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [ { "lessThan": "11.00", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-37164", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/37xxx/CVE-2025-37164.json", "fetchedAt": "2026-10-23T02:43:38.018Z", "publishedAt": "2025-12-16T16:30:34.524Z", "modifiedAt": "2026-02-26T16:07:33.179Z", "state": "published", "provider": "hpe", "title": "", "descriptions": [ { "lang": "en", "value": "A remote code execution issue exists in HPE OneView.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE OneView", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "11.00", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "hpe", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US", "label": "hpe", "tags": [], "provider": "hpe", "sourcePath": "/containers/cna/references/0" }, { "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1", "label": "CISA-ADP", "tags": [ "vendor-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hpe_oneview_rce.rb", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-37164", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/2" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/37xxx/CVE-2025-37164.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"HPE OneView\",\"vendor\":\"Hewlett Packard Enterprise (HPE)\",\"versions\":[{\"lessThan\":\"11.00\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/37xxx/CVE-2025-37164.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A remote code execution issue exists in HPE OneView.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/37xxx/CVE-2025-37164.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T16:07:33.179Z", "fetchedAt": "2026-10-23T02:43:38.018Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-01-07T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "HPE OneViewにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:18.813Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "151be5d2075b79f2e174990fb96b630b2aba80038db665bfdc288bf527a003ef", "sourceModifiedAt": "2026-02-26T16:07:33.179Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "HPE OneView にリモートコード実行の問題が存在します。", "risk": "CISA はこの脆弱性が実際に悪用されたと報告しています。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "バージョン 11.00 未満の HPE OneView が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/37xxx/CVE-2025-37164.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Hewlett Packard Enterprise (HPE) / HPE OneView。影響ありとして記載：11.00未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/37xxx/CVE-2025-37164.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-37164" ], "evidenceIds": [ "E2" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/37xxx/CVE-2025-37164.json" ], "evidenceIds": [ "E3" ] }, { "text": "「HPE OneView」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-37164", "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-37164", "https://nvd.nist.gov/vuln/detail/CVE-2025-37164" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/37xxx/CVE-2025-37164.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-37164", "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-37164", "https://nvd.nist.gov/vuln/detail/CVE-2025-37164" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/37xxx/CVE-2025-37164.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-37164", "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-37164", "https://nvd.nist.gov/vuln/detail/CVE-2025-37164" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/37xxx/CVE-2025-37164.json", "label": "CVE：hpe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-37164", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-37164", "label": "CVE公式レコード" }, { "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37164", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/37xxx/CVE-2025-37164.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A remote code execution issue exists in HPE OneView.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-37164", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-37164\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/37xxx/CVE-2025-37164.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"HPE OneView\",\"vendor\":\"Hewlett Packard Enterprise (HPE)\",\"versions\":[{\"lessThan\":\"11.00\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2025-37164（HPE OneView）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・バージョン 11.00 未満の HPE OneView が影響を受けます。\n・公式の対象表：Hewlett Packard Enterprise (HPE) / HPE OneView。影響ありとして記載：11.00未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-37164", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:18.813Z", "lastSuccess": "2026-10-23T03:25:18.813Z", "sourceCheckedAt": "2026-10-23T02:43:38.018Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-14847", "aliases": [], "title": "MongoDB Server：脆弱性情報", "summary": "Zlib 圧縮プロトコルヘッダーの長さフィールドが不一致になると、認証されていないクライアントが未初期化のヒープメモリを読み取ることができる可能性があります。この問題は、MongoDB Server の以下のバージョンに影響します：MongoDB Server v7.0（7.0.28 未満）、v8.0（8.0.17 未満）、v8.2（8.2.3 未満）、v6.0（6.0.27 未満）、v5.0（5.0.32 未満）、v4.4（4.4.30 未満）、v4.2（4.2.0 以降）、v4.0（4.0.0 以降）、v3.6（3.6.0 以降）。", "risk": "未初期化ヒープメモリの内容が読み取られる可能性がある。", "product": "MongoDB Server", "category": "other", "component": "package", "severity": "high", "cvss": 8.7, "cvssVersion": "4.0", "cvssSource": "mongodb", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "affected": [ { "product": "MongoDB Server", "range": ">= 8.2 / < 8.2.3" }, { "product": "MongoDB Server", "range": ">= 8.0 / < 8.0.17" }, { "product": "MongoDB Server", "range": ">= 7.0 / < 7.0.28" }, { "product": "MongoDB Server", "range": ">= 6.0 / < 6.0.27" }, { "product": "MongoDB Server", "range": ">= 5.0 / < 5.0.32" }, { "product": "MongoDB Server", "range": ">= 4.4 / < 4.4.30" }, { "product": "MongoDB Server", "range": "4.2" }, { "product": "MongoDB Server", "range": "4.0" }, { "product": "MongoDB Server", "range": "3.6" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json", "label": "CVE：mongodb" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14847", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14847", "label": "CVE公式レコード" }, { "url": "https://jira.mongodb.org/browse/SERVER-115508", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14847", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-12-19T11:00:22.465Z", "modifiedAt": "2026-02-26T16:07:25.054Z", "fetchedAt": "2026-10-23T02:43:35.612Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.", "sourceTitle": "Zlib compressed protocol header length confusion may allow memory read", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "MongoDB Server", "vendor": "MongoDB Inc.", "versions": [ { "lessThan": "8.2.3", "status": "affected", "version": "8.2", "versionType": "custom" }, { "lessThan": "8.0.17", "status": "affected", "version": "8.0", "versionType": "custom" }, { "lessThan": "7.0.28", "status": "affected", "version": "7.0", "versionType": "custom" }, { "lessThan": "6.0.27", "status": "affected", "version": "6.0", "versionType": "custom" }, { "lessThan": "5.0.32", "status": "affected", "version": "5.0", "versionType": "custom" }, { "lessThan": "4.4.30", "status": "affected", "version": "4.4", "versionType": "custom" }, { "status": "affected", "version": "4.2", "versionType": "custom" }, { "status": "affected", "version": "4.0", "versionType": "custom" }, { "status": "affected", "version": "3.6", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-14847", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json", "fetchedAt": "2026-10-23T02:43:35.612Z", "publishedAt": "2025-12-19T11:00:22.465Z", "modifiedAt": "2026-02-26T16:07:25.054Z", "state": "published", "provider": "mongodb", "title": "Zlib compressed protocol header length confusion may allow memory read", "descriptions": [ { "lang": "en", "value": "Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "MongoDB Inc.", "product": "MongoDB Server", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2", "lessThan": "8.2.3", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.0", "lessThan": "8.0.17", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "7.0", "lessThan": "7.0.28", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "6.0", "lessThan": "6.0.27", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "5.0", "lessThan": "5.0.32", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "4.4", "lessThan": "4.4.30", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "4.2", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "4.0", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "3.6", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-130", "lang": "en", "description": "CWE-130: Improper Handling of Length Parameter Inconsistency", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "baseScore": 8.7, "baseSeverity": "HIGH", "provider": "mongodb", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" }, { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "mongodb", "sourcePath": "/containers/cna/metrics/1/cvssV3_1" } ], "references": [ { "url": "https://jira.mongodb.org/browse/SERVER-115508", "label": "mongodb", "tags": [], "provider": "mongodb", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14847", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://www.openwall.com/lists/oss-security/2025/12/29/21", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-14847-detection-script-heap-memory-exposure-in-mongodb-server", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-14847-mitigation-script-heap-memory-exposure-in-mongodb-server", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://www.smartkeyss.com/post/mongobleed-pre-auth-memory-disclosure-via-op_compressed-in-mongodb-cve-2025-14847", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/3" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"MongoDB Server\",\"vendor\":\"MongoDB Inc.\",\"versions\":[{\"lessThan\":\"8.2.3\",\"status\":\"affected\",\"version\":\"8.2\",\"versionType\":\"custom\"},{\"lessThan\":\"8.0.17\",\"status\":\"affected\",\"version\":\"8.0\",\"versionType\":\"custom\"},{\"lessThan\":\"7.0.28\",\"status\":\"affected\",\"version\":\"7.0\",\"versionType\":\"custom\"},{\"lessThan\":\"6.0.27\",\"status\":\"affected\",\"version\":\"6.0\",\"versionType\":\"custom\"},{\"lessThan\":\"5.0.32\",\"status\":\"affected\",\"version\":\"5.0\",\"versionType\":\"custom\"},{\"lessThan\":\"4.4.30\",\"status\":\"affected\",\"version\":\"4.4\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.2\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.0\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"3.6\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-130\",\"description\":\"CWE-130: Improper Handling of Length Parameter Inconsistency\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"attackVector\":\"NETWORK\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"NONE\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/1/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json", "sourcePath": "/containers/cna/metrics/1/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T16:07:25.054Z", "fetchedAt": "2026-10-23T02:43:35.612Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-12-29T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "MongoDB Serverに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:19.388Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "2b53e4fe4a970c0b5995893de4d95d4b329dd533a184474b44c2523bc1579651", "sourceModifiedAt": "2026-02-26T16:07:25.054Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Zlib 圧縮プロトコルヘッダーの長さフィールドが不一致になると、認証されていないクライアントが未初期化のヒープメモリを読み取ることができる可能性があります。この問題は、MongoDB Server の以下のバージョンに影響します：MongoDB Server v7.0（7.0.28 未満）、v8.0（8.0.17 未満）、v8.2（8.2.3 未満）、v6.0（6.0.27 未満）、v5.0（5.0.32 未満）、v4.4（4.4.30 未満）、v4.2（4.2.0 以降）、v4.0（4.0.0 以降）、v3.6（3.6.0 以降）。", "risk": "未初期化ヒープメモリの内容が読み取られる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "MongoDB Server 7.0 系で、バージョン 7.0.28 未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "MongoDB Server 8.0 系で、バージョン 8.0.17 未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "MongoDB Server 8.2 系で、バージョン 8.2.3 未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "MongoDB Server 6.0 系で、バージョン 6.0.27 未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "MongoDB Server 5.0 系で、バージョン 5.0.32 未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "MongoDB Server 4.4 系で、バージョン 4.4.30 未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "MongoDB Server 4.2 系（4.2.0 以降）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "MongoDB Server 4.0 系（4.0.0 以降）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "MongoDB Server 3.6 系（3.6.0 以降）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：MongoDB Inc. / MongoDB Server。影響ありとして記載：8.2以上、8.2.3未満。影響ありとして記載：8.0以上、8.0.17未満。影響ありとして記載：7.0以上、7.0.28未満。影響ありとして記載：6.0以上、6.0.27未満。影響ありとして記載：5.0以上、5.0.32未満。影響ありとして記載：4.4以上、4.4.30未満。影響ありとして記載：4.2。影響ありとして記載：4.0。影響ありとして記載：3.6。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14847" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json" ], "evidenceIds": [ "E3" ] }, { "text": "「MongoDB Server」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-14847", "https://jira.mongodb.org/browse/SERVER-115508", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14847", "https://nvd.nist.gov/vuln/detail/CVE-2025-14847" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-14847", "https://jira.mongodb.org/browse/SERVER-115508", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14847", "https://nvd.nist.gov/vuln/detail/CVE-2025-14847" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-14847", "https://jira.mongodb.org/browse/SERVER-115508", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14847", "https://nvd.nist.gov/vuln/detail/CVE-2025-14847" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json", "label": "CVE：mongodb" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14847", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14847", "label": "CVE公式レコード" }, { "url": "https://jira.mongodb.org/browse/SERVER-115508", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14847", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json", "sourceField": "/containers/cna/title", "excerpt": "Zlib compressed protocol header length confusion may allow memory read", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14847.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"MongoDB Server\",\"vendor\":\"MongoDB Inc.\",\"versions\":[{\"lessThan\":\"8.2.3\",\"status\":\"affected\",\"version\":\"8.2\",\"versionType\":\"custom\"},{\"lessThan\":\"8.0.17\",\"status\":\"affected\",\"version\":\"8.0\",\"versionType\":\"custom\"},{\"lessThan\":\"7.0.28\",\"status\":\"affected\",\"version\":\"7.0\",\"versionType\":\"custom\"},{\"lessThan\":\"6.0.27\",\"status\":\"affected\",\"version\":\"6.0\",\"versionType\":\"custom\"},{\"lessThan\":\"5.0.32\",\"status\":\"affected\",\"version\":\"5.0\",\"versionType\":\"custom\"},{\"lessThan\":\"4.4.30\",\"status\":\"affected\",\"version\":\"4.4\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.2\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.0\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"3.6\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14847", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-14847\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-14847（MongoDB Server）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・MongoDB Server 7.0 系で、バージョン 7.0.28 未満。\n・MongoDB Server 8.0 系で、バージョン 8.0.17 未満。\n・MongoDB Server 8.2 系で、バージョン 8.2.3 未満。\n・MongoDB Server 6.0 系で、バージョン 6.0.27 未満。\n・MongoDB Server 5.0 系で、バージョン 5.0.32 未満。\n・MongoDB Server 4.4 系で、バージョン 4.4.30 未満。\n・MongoDB Server 4.2 系（4.2.0 以降）。\n・MongoDB Server 4.0 系（4.0.0 以降）。\n・MongoDB Server 3.6 系（3.6.0 以降）。\n・公式の対象表：MongoDB Inc. / MongoDB Server。影響ありとして記載：8.2以上、8.2.3未満。影響ありとして記載：8.0以上、8.0.17未満。影響ありとして記載：7.0以上、7.0.28未満。影響ありとして記載：6.0以上、6.0.27未満。影響ありとして記載：5.0以上、5.0.32未満。影響ありとして記載：4.4以上、4.4.30未満。影響ありとして記載：4.2。影響ありとして記載：4.0。影響ありとして記載：3.6。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-14847", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:19.388Z", "lastSuccess": "2026-10-23T03:25:19.388Z", "sourceCheckedAt": "2026-10-23T02:43:35.612Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-52163", "aliases": [], "title": "n/a：脆弱性情報", "summary": "Digiever DS-2105 Pro のバージョン 3.1.0.71-11 において、time_tzsetup.cgi に対するコマンドインジェクションが可能です。この脆弱性はメンテナがもはやサポートしていない製品にのみ影響します。", "risk": "コマンドインジェクションにより、攻撃者が任意のコマンドを実行できる可能性があります。", "product": "Digiever DS-2105 Pro", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-52163", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-52163", "label": "CVE公式レコード" }, { "url": "https://www.txone.com/blog/digiever-fixes-sorely-needed/", "label": "CVE掲載の参考情報" }, { "url": "https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing", "label": "CVE掲載の参考情報" }, { "url": "https://www.digiever.com/tw/support/faq-content.php?FAQ=217", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52163", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-02-03T00:00:00.000Z", "modifiedAt": "2026-02-26T19:09:25.945Z", "fetchedAt": "2026-10-23T02:43:29.395Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "n/a", "product": "n/a", "versions": [ { "version": "n/a", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-52163", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json", "fetchedAt": "2026-10-23T02:43:29.395Z", "publishedAt": "2025-02-03T00:00:00.000Z", "modifiedAt": "2026-02-26T19:09:25.945Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.txone.com/blog/digiever-fixes-sorely-needed/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-52163", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.fortinet.com/blog/threat-research/shadowv2-casts-a-shadow-over-iot-devices", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"text\",\"lang\":\"en\",\"description\":\"n/a\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T19:09:25.945Z", "fetchedAt": "2026-10-23T02:43:29.395Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-12-22T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:38:34.294Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "eeddadd99bba26bfd7c33b8eef85166e3806c11d6c673226a3d54f7540487aa5", "sourceModifiedAt": "2026-02-26T19:09:25.945Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Digiever DS-2105 Pro のバージョン 3.1.0.71-11 において、time_tzsetup.cgi に対するコマンドインジェクションが可能です。この脆弱性はメンテナがもはやサポートしていない製品にのみ影響します。", "risk": "コマンドインジェクションにより、攻撃者が任意のコマンドを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象製品は Digiever DS-2105 Pro で、バージョンは 3.1.0.71-11 です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json" ], "evidenceIds": [ "E1" ] }, { "text": "この脆弱性はメンテナがサポートを終了した製品にのみ影響します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-52163" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Digiever DS-2105 Pro」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-52163", "https://www.txone.com/blog/digiever-fixes-sorely-needed/", "https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-52163", "https://www.digiever.com/tw/support/faq-content.php?FAQ=217", "https://nvd.nist.gov/vuln/detail/CVE-2023-52163" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-52163", "https://www.txone.com/blog/digiever-fixes-sorely-needed/", "https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-52163", "https://www.digiever.com/tw/support/faq-content.php?FAQ=217", "https://nvd.nist.gov/vuln/detail/CVE-2023-52163" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-52163", "https://www.txone.com/blog/digiever-fixes-sorely-needed/", "https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-52163", "https://www.digiever.com/tw/support/faq-content.php?FAQ=217", "https://nvd.nist.gov/vuln/detail/CVE-2023-52163" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-52163", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-52163", "label": "CVE公式レコード" }, { "url": "https://www.txone.com/blog/digiever-fixes-sorely-needed/", "label": "CVE掲載の参考情報" }, { "url": "https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing", "label": "CVE掲載の参考情報" }, { "url": "https://www.digiever.com/tw/support/faq-content.php?FAQ=217", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52163", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/52xxx/CVE-2023-52163.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-52163", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-52163\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-52163（Digiever DS-2105 Pro）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象製品は Digiever DS-2105 Pro で、バージョンは 3.1.0.71-11 です。\n・この脆弱性はメンテナがサポートを終了した製品にのみ影響します。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-52163", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:38:34.294Z", "lastSuccess": "2026-10-23T03:38:34.294Z", "sourceCheckedAt": "2026-10-23T02:43:29.395Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-14733", "aliases": [], "title": "Fireware OS：コード実行", "summary": "WatchGuard Fireware OS の iked プロセスにおける範囲外書き込みの脆弱性により、リモートの認証されていない攻撃者が任意のコードを実行できる可能性があります。この脆弱性は、IKEv2 を使用したモバイルユーザー VPN と、動的ゲートウェイピアで構成された IKEv2 を使用した支店オフィス VPN の両方に影響します。過去にこれらの構成が設定されていて削除された場合でも、支店オフィス VPN が静的ゲートウェイピアに対して構成されていると、依然として脆弱です。", "risk": "リモートの認証されていない攻撃者が任意のコードを実行できる可能性があります。", "product": "Fireware OS", "category": "other", "component": "package", "severity": "critical", "cvss": 9.3, "cvssVersion": "4.0", "cvssSource": "WatchGuard", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red", "affected": [ { "product": "Fireware OS", "range": ">= 2025.1 / < 2025.1.4（環境: Default）" }, { "product": "Fireware OS", "range": ">= 12.0 / < 12.11.6（環境: Default）" }, { "product": "Fireware OS", "range": ">= 11.10.2 / <= 11.12.4+541730（環境: Default）" }, { "product": "Fireware OS", "range": ">= 12.0 / < 12.3.1+728352（環境: FIPS）" }, { "product": "Fireware OS", "range": ">= 12.0 / < 12.5.15（環境: T15/T35）" } ], "fixed": [], "steps": [ "Fireware OS 2025.1.4、Fireware OS 12.11.6、Fireware OS 12.5.15、Fireware OS 12.3.1-b728352 を含む、脆弱性が修正された最新の Fireware OS にアップグレードしてください。また、脅威アクターの活動が確認された場合は、Firebox に保存されているすべてのローカルシークレットを、WatchGuard のナレッジベース記事「Best Practices to Rotate Shared Secrets Stored on the Firebox」に従ってローテーションしてください。", "「CVE-2025-14733」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "label": "CVE：WatchGuard" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14733", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14733", "label": "CVE公式レコード" }, { "url": "https://psirt.watchguard.com/CVE-2025-14733", "label": "CVE掲載の参考情報" }, { "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14733", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-12-19T00:01:55.722Z", "modifiedAt": "2026-09-09T04:18:10.655Z", "fetchedAt": "2026-10-23T02:43:35.562Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\n\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.", "sourceTitle": "WatchGuard Firebox iked Out of Bounds Write Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "WatchGuard", "product": "Fireware OS", "versions": [ { "status": "affected", "version": "2025.1", "versionType": "custom", "lessThan": "2025.1.4" }, { "status": "affected", "version": "12.0", "versionType": "custom", "lessThan": "12.11.6" }, { "status": "affected", "version": "11.10.2", "versionType": "custom", "lessThanOrEqual": "11.12.4+541730" } ], "defaultStatus": "unaffected", "platforms": [ "Default" ] }, { "vendor": "WatchGuard", "product": "Fireware OS", "versions": [ { "status": "affected", "version": "12.0", "versionType": "custom", "lessThan": "12.3.1+728352" } ], "defaultStatus": "unaffected", "platforms": [ "FIPS" ] }, { "vendor": "WatchGuard", "product": "Fireware OS", "versions": [ { "status": "affected", "version": "12.0", "versionType": "custom", "lessThan": "12.5.15" } ], "defaultStatus": "unaffected", "platforms": [ "T15/T35" ] } ], "configurationNotes": "対象環境・機能: Default / FIPS / T15/T35。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-14733", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "fetchedAt": "2026-10-23T02:43:35.562Z", "publishedAt": "2025-12-19T00:01:55.722Z", "modifiedAt": "2026-09-09T04:18:10.655Z", "state": "published", "provider": "WatchGuard", "title": "WatchGuard Firebox iked Out of Bounds Write Vulnerability", "descriptions": [ { "lang": "en", "value": "An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\n\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "WatchGuard", "product": "Fireware OS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [ "Default" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "2025.1", "lessThan": "2025.1.4", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "12.0", "lessThan": "12.11.6", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "11.10.2", "lessThanOrEqual": "11.12.4+541730", "versionType": "custom", "status": "affected" } ] }, { "vendor": "WatchGuard", "product": "Fireware OS", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [ "FIPS" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "12.0", "lessThan": "12.3.1+728352", "versionType": "custom", "status": "affected" } ] }, { "vendor": "WatchGuard", "product": "Fireware OS", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [ "T15/T35" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "12.0", "lessThan": "12.5.15", "versionType": "custom", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Fireware OS 2025.1.4, Fireware OS 12.11.6, Fireware OS 12.5.15, Fireware OS 12.3.1-b728352 In addition to installing the latest Fireware OS that contains the fix, administrators that have confirmed threat actor activity on their Firebox appliances must take precautions to rotate all locally stored secrets on vulnerable Firebox appliances as described in our Best Practices to Rotate Shared Secrets Stored on the Firebox knowledge base article (https://techsearch.watchguard.com/KB?type=Article&SFDCID=kA1Vr000000DNMzKAO&lang=en_US).", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [ { "lang": "en", "value": "If your Firebox is only configured with Branch Office VPN tunnels to static gateway peers and you are not able to immediately upgrade the device to a version of Fireware OS with the vulnerability resolution, you can follow WatchGuard’s recommendations for Secure Access to Branch Office VPNs that Use IPSec and IKEv2 (https://techsearch.watchguard.com/KB?type=Article&SFDCID=kA1Vr000000DMXNKA4&lang=en_US) as a temporary workaround.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [ { "lang": "en", "value": "WatchGuard has observed threat actors actively attempting to exploit this vulnerability in the wild.\nPost-Exploit Activity\nWe have identified two variants of post-exploit activity targeting exposed Firebox appliances. In one variant, the threat actor encrypts and then exfiltrates the active configuration file from the Firebox to the same IP address that the attack originates from. In the second variant, the threat actor creates a gzip archive with both the active configuration file and the local management user database and exfiltrates the archive to the same IP address that the attack originates from. In all instances where a successful exploit is suspected, Firebox administrators should follow the remediation guidance described below and rotate all secrets stored on the Firebox.\nIndicators of Attack\nWe are providing the following Indicators of Attack (IoAs) to help device owners identify potential attempts to exploit this vulnerability against vulnerable Firebox appliances. These IoAs are only applicable on devices that lack the resolution described later in this advisory.\nIP Addresses\nThe following IP addresses are directly associated with known threat actor activity. Outbound connections to these IPs are a strong indicator of compromise. Inbound connections from these IPs could indicate reconnaissance efforts or exploit attempts.\n- 45.95.19[.]50\n- 51.15.17[.]89\n- 172.93.107[.]67\n- 199.247.7[.]82\n- 38.252.8[.]14 - Added Dec 29\n- 94.249.197[.]106 - Added Dec 29\nLogs\nInvalid peer certificate chain\nWith the iked diagnostic logging set to the default error logging level, the iked process generates a log message when the Firebox receives an IKE2 Auth payload with more than 8 certificates. This is a medium indicator of attack that the WatchGuard Threat Lab has observed associated with some threat actor activity.\n1970-01-01 01:00:00 2025 Firebox-Name local3.err iked[2938]: (203.0.113.1<->203.0.113.2) Received peer certificate chain is longer than 8. Reject this certificate chain\nAbnormally large IKE_AUTH request CERT payload\nWith the iked diagnostic logging set to the info logging level, the iked process generates a log message when the Firebox receives an IKE_AUTH request message. An IKE_AUTH request log message with an abnormally large CERT payload size (greater than 2000 bytes) is a strong indicator of an attack. This is a strong indicator of attack.\n1970-01-01 01:00:00 iked (203.0.113.1<->203.0.113.2)\"IKE_AUTH request\" message has 6 payloads [ IDi(sz=21) CERT(sz=3000) SA(sz=44) TSi(sz=24) TSr(sz=24) N(sz=8)]\nDevice Behavior\nIKE process hang\nDuring a successful exploit, the IKED process (responsible for handling IKE negotiations) will hang, interrupting VPN tunnel negotiations and re-keys. This is a strong indicator of attack. Existing tunnels may continue to pass traffic.\nIKE process crash\nAfter a failed or successful exploit, the IKED process will crash and generate a fault report on the Firebox. Be aware, there are other situations that could cause the IKED process to crash. This is a weak indicator of attack.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-787", "lang": "en", "description": "CWE-787", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red", "baseScore": 9.3, "baseSeverity": "CRITICAL", "provider": "WatchGuard", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://psirt.watchguard.com/CVE-2025-14733", "label": "WatchGuard", "tags": [ "vendor-advisory" ], "provider": "WatchGuard", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027", "label": "WatchGuard", "tags": [ "vendor-advisory" ], "provider": "WatchGuard", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14733", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"WatchGuard\",\"product\":\"Fireware OS\",\"versions\":[{\"status\":\"affected\",\"version\":\"2025.1\",\"versionType\":\"custom\",\"lessThan\":\"2025.1.4\"},{\"status\":\"affected\",\"version\":\"12.0\",\"versionType\":\"custom\",\"lessThan\":\"12.11.6\"},{\"status\":\"affected\",\"version\":\"11.10.2\",\"versionType\":\"custom\",\"lessThanOrEqual\":\"11.12.4+541730\"}],\"defaultStatus\":\"unaffected\",\"platforms\":[\"Default\"]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"WatchGuard\",\"product\":\"Fireware OS\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.0\",\"versionType\":\"custom\",\"lessThan\":\"12.3.1+728352\"}],\"defaultStatus\":\"unaffected\",\"platforms\":[\"FIPS\"]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"WatchGuard\",\"product\":\"Fireware OS\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.0\",\"versionType\":\"custom\",\"lessThan\":\"12.5.15\"}],\"defaultStatus\":\"unaffected\",\"platforms\":[\"T15/T35\"]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\n\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Fireware OS 2025.1.4, Fireware OS 12.11.6, Fireware OS 12.5.15, Fireware OS 12.3.1-b728352 In addition to installing the latest Fireware OS that contains the fix, administrators that have confirmed threat actor activity on their Firebox appliances must take precautions to rotate all locally stored secrets on vulnerable Firebox appliances as described in our Best Practices to Rotate Shared Secrets Stored on the Firebox knowledge base article (https://techsearch.watchguard.com/KB?type=Article&SFDCID=kA1Vr000000DNMzKAO&lang=en_US).", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "If your Firebox is only configured with Branch Office VPN tunnels to static gateway peers and you are not able to immediately upgrade the device to a version of Fireware OS with the vulnerability resolution, you can follow WatchGuard’s recommendations for Secure Access to Branch Office VPNs that Use IPSec and IKEv2 (https://techsearch.watchguard.com/KB?type=Article&SFDCID=kA1Vr000000DMXNKA4&lang=en_US) as a temporary workaround.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "WatchGuard has observed threat actors actively attempting to exploit this vulnerability in the wild.\nPost-Exploit Activity\nWe have identified two variants of post-exploit activity targeting exposed Firebox appliances. In one variant, the threat actor encrypts and then exfiltrates the active configuration file from the Firebox to the same IP address that the attack originates from. In the second variant, the threat actor creates a gzip archive with both the active configuration file and the local management user database and exfiltrates the archive to the same IP address that the attack originates from. In all instances where a successful exploit is suspected, Firebox administrators should follow the remediation guidance described below and rotate all secrets stored on the Firebox.\nIndicators of Attack\nWe are providing the following Indicators of Attack (IoAs) to help device owners identify potential attempts to exploit this vulnerability against vulnerable Firebox appliances. These IoAs are only applicable on devices that lack the resolution described later in this advisory.\nIP Addresses\nThe following IP addresses are directly associated with known threat actor activity. Outbound connections to these IPs are a strong indicator of compromise. Inbound connections from these IPs could indicate reconnaissance efforts or exploit attempts.\n- 45.95.19[.]50\n- 51.15.17[.]89\n- 172.93.107[.]67\n- 199.247.7[.]82\n- 38.252.8[.]14 - Added Dec 29\n- 94.249.197[.]106 - Added Dec 29\nLogs\nInvalid peer certificate chain\nWith the iked diagnostic logging set to the default error logging level, the iked process generates a log message when the Firebox receives an IKE2 Auth payload with more than 8 certificates. This is a medium indicator of attack that the WatchGuard Threat Lab has observed associated with some threat actor activity.\n1970-01-01 01:00:00 2025 Firebox-Name local3.err iked[2938]: (203.0.113.1<->203.0.113.2) Received peer certificate chain is longer than 8. Reject this certificate chain\nAbnormally large IKE_AUTH request CERT payload\nWith the iked diagnostic logging set to the info logging level, the iked process generates a log message when the Firebox receives an IKE_AUTH request message. An IKE_AUTH request log message with an abnormally large CERT payload size (greater than 2000 bytes) is a strong indicator of an attack. This is a strong indicator of attack.\n1970-01-01 01:00:00 iked (203.0.113.1<->203.0.113.2)\"IKE_AUTH request\" message has 6 payloads [ IDi(sz=21) CERT(sz=3000) SA(sz=44) TSi(sz=24) TSr(sz=24) N(sz=8)]\nDevice Behavior\nIKE process hang\nDuring a successful exploit, the IKED process (responsible for handling IKE negotiations) will hang, interrupting VPN tunnel negotiations and re-keys. This is a strong indicator of attack. Existing tunnels may continue to pass traffic.\nIKE process crash\nAfter a failed or successful exploit, the IKED process will crash and generate a fault report on the Firebox. Be aware, there are other situations that could cause the IKED process to crash. This is a weak indicator of attack.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-787\",\"type\":\"CWE\",\"cweId\":\"CWE-787\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-09T04:18:10.655Z", "fetchedAt": "2026-10-23T02:43:35.562Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-12-19T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Fireware OSにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:21.768Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "7582091224da58fe7df8942d77c97e803f0774ebe5b4138ba2f1b803a4f3a045", "sourceModifiedAt": "2026-09-09T04:18:10.655Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "WatchGuard Fireware OS の iked プロセスにおける範囲外書き込みの脆弱性により、リモートの認証されていない攻撃者が任意のコードを実行できる可能性があります。この脆弱性は、IKEv2 を使用したモバイルユーザー VPN と、動的ゲートウェイピアで構成された IKEv2 を使用した支店オフィス VPN の両方に影響します。過去にこれらの構成が設定されていて削除された場合でも、支店オフィス VPN が静的ゲートウェイピアに対して構成されていると、依然として脆弱です。", "risk": "リモートの認証されていない攻撃者が任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Fireware OS 2025.1 系でバージョンが 2025.1.4 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Fireware OS 12.0 系でバージョンが 12.11.6 未満のものは影響を受けます（デフォルトプラットフォーム）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Fireware OS 12.0 系でバージョンが 12.3.1+728352 未満のものは FIPS プラットフォームで影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Fireware OS 12.0 系でバージョンが 12.5.15 未満のものは T15/T35 プラットフォームで影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "Fireware OS 11.10.2 系でバージョンが 11.12.4+541730 以下のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "IKEv2 を使用したモバイルユーザー VPN が設定されている場合、または動的ゲートウェイピアで構成された IKEv2 支店オフィス VPN が設定されている場合に影響します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "上記の構成が削除された後でも、支店オフィス VPN が静的ゲートウェイピアに対して構成されていると、依然として脆弱です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：WatchGuard / Fireware OS。影響ありとして記載：2025.1以上、2025.1.4未満。影響ありとして記載：12.0以上、12.11.6未満。影響ありとして記載：11.10.2以上、11.12.4+541730以下。対象の環境：Default", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：WatchGuard / Fireware OS。影響ありとして記載：12.0以上、12.3.1+728352未満。対象の環境：FIPS", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：WatchGuard / Fireware OS。影響ありとして記載：12.0以上、12.5.15未満。対象の環境：T15/T35", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14733" ], "evidenceIds": [ "E8" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Fireware OS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-14733", "https://psirt.watchguard.com/CVE-2025-14733", "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14733", "https://nvd.nist.gov/vuln/detail/CVE-2025-14733" ] } ], "actions": [ { "text": "Fireware OS 2025.1.4、Fireware OS 12.11.6、Fireware OS 12.5.15、Fireware OS 12.3.1-b728352 を含む、脆弱性が修正された最新の Fireware OS にアップグレードしてください。また、脅威アクターの活動が確認された場合は、Firebox に保存されているすべてのローカルシークレットを、WatchGuard のナレッジベース記事「Best Practices to Rotate Shared Secrets Stored on the Firebox」に従ってローテーションしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E6" ] }, { "text": "「CVE-2025-14733」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-14733", "https://psirt.watchguard.com/CVE-2025-14733", "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14733", "https://nvd.nist.gov/vuln/detail/CVE-2025-14733" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-14733", "https://psirt.watchguard.com/CVE-2025-14733", "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14733", "https://nvd.nist.gov/vuln/detail/CVE-2025-14733" ] } ], "temporaryMitigations": [ { "text": "Firebox が静的ゲートウェイピアへの支店オフィス VPN のみで構成され、すぐに脆弱性が修正された Fireware OS にアップグレードできない場合は、WatchGuard の記事「Secure Access to Branch Office VPNs that Use IPSec and IKEv2」の推奨手順に従って一時的な回避策を実施してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E7" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-14733", "https://psirt.watchguard.com/CVE-2025-14733", "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14733", "https://nvd.nist.gov/vuln/detail/CVE-2025-14733" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "label": "CVE：WatchGuard" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14733", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14733", "label": "CVE公式レコード" }, { "url": "https://psirt.watchguard.com/CVE-2025-14733", "label": "CVE掲載の参考情報" }, { "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14733", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\n\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourceField": "/containers/cna/title", "excerpt": "WatchGuard Firebox iked Out of Bounds Write Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"WatchGuard\",\"product\":\"Fireware OS\",\"versions\":[{\"status\":\"affected\",\"version\":\"2025.1\",\"versionType\":\"custom\",\"lessThan\":\"2025.1.4\"},{\"status\":\"affected\",\"version\":\"12.0\",\"versionType\":\"custom\",\"lessThan\":\"12.11.6\"},{\"status\":\"affected\",\"version\":\"11.10.2\",\"versionType\":\"custom\",\"lessThanOrEqual\":\"11.12.4+541730\"}],\"defaultStatus\":\"unaffected\",\"platforms\":[\"Default\"]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"WatchGuard\",\"product\":\"Fireware OS\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.0\",\"versionType\":\"custom\",\"lessThan\":\"12.3.1+728352\"}],\"defaultStatus\":\"unaffected\",\"platforms\":[\"FIPS\"]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"WatchGuard\",\"product\":\"Fireware OS\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.0\",\"versionType\":\"custom\",\"lessThan\":\"12.5.15\"}],\"defaultStatus\":\"unaffected\",\"platforms\":[\"T15/T35\"]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Fireware OS 2025.1.4, Fireware OS 12.11.6, Fireware OS 12.5.15, Fireware OS 12.3.1-b728352 In addition to installing the latest Fireware OS that contains the fix, administrators that have confirmed threat actor activity on their Firebox appliances must take precautions to rotate all locally stored secrets on vulnerable Firebox appliances as described in our Best Practices to Rotate Shared Secrets Stored on the Firebox knowledge base article (https://techsearch.watchguard.com/KB?type=Article&SFDCID=kA1Vr000000DNMzKAO&lang=en_US).", "language": "en", "representation": "source_excerpt" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14733.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "If your Firebox is only configured with Branch Office VPN tunnels to static gateway peers and you are not able to immediately upgrade the device to a version of Fireware OS with the vulnerability resolution, you can follow WatchGuard’s recommendations for Secure Access to Branch Office VPNs that Use IPSec and IKEv2 (https://techsearch.watchguard.com/KB?type=Article&SFDCID=kA1Vr000000DMXNKA4&lang=en_US) as a temporary workaround.", "language": "en", "representation": "source_excerpt" }, { "id": "E8", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14733", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-14733\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-14733（Fireware OS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Fireware OS 2025.1 系でバージョンが 2025.1.4 未満のものは影響を受けます。\n・Fireware OS 12.0 系でバージョンが 12.11.6 未満のものは影響を受けます（デフォルトプラットフォーム）。\n・Fireware OS 12.0 系でバージョンが 12.3.1+728352 未満のものは FIPS プラットフォームで影響を受けます。\n・Fireware OS 12.0 系でバージョンが 12.5.15 未満のものは T15/T35 プラットフォームで影響を受けます。\n・Fireware OS 11.10.2 系でバージョンが 11.12.4+541730 以下のものは影響を受けます。\n・IKEv2 を使用したモバイルユーザー VPN が設定されている場合、または動的ゲートウェイピアで構成された IKEv2 支店オフィス VPN が設定されている場合に影響します。\n・上記の構成が削除された後でも、支店オフィス VPN が静的ゲートウェイピアに対して構成されていると、依然として脆弱です。\n・公式の対象表：WatchGuard / Fireware OS。影響ありとして記載：2025.1以上、2025.1.4未満。影響ありとして記載：12.0以上、12.11.6未満。影響ありとして記載：11.10.2以上、11.12.4+541730以下。対象の環境：Default\n・公式の対象表：WatchGuard / Fireware OS。影響ありとして記載：12.0以上、12.3.1+728352未満。対象の環境：FIPS\n・公式の対象表：WatchGuard / Fireware OS。影響ありとして記載：12.0以上、12.5.15未満。対象の環境：T15/T35\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-14733", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:21.768Z", "lastSuccess": "2026-10-23T03:25:21.768Z", "sourceCheckedAt": "2026-10-23T02:43:35.562Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "GHSA-www2-q4fc-65wf", "aliases": [], "title": "PHP：脆弱性情報", "summary": "GHSA-3cr5-j632-f35r と同様に、null バイトで文字列が終端される問題が発生します。dns_get_record() などの DNS 関数は null のチェックを行わないため、サーバー側リクエスト偽装（SSRF）や予期しない動作が起こる可能性があります。", "risk": "サーバー側リクエスト偽装（SSRF）が発生する可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "low", "cvss": null, "cvssVersion": null, "cvssSource": "PHP Security", "cvssVector": null, "affected": [ { "product": "PHP 8.1系 / php-src", "range": "< 8.1.34（修正版 8.1.34 に対応する系列。旧系列の影響は原文確認）" }, { "product": "PHP 8.2系 / php-src", "range": "< 8.2.30（修正版 8.2.30 に対応する系列。旧系列の影響は原文確認）" }, { "product": "PHP 8.3系 / php-src", "range": "< 8.3.29（修正版 8.3.29 に対応する系列。旧系列の影響は原文確認）" }, { "product": "PHP 8.4系 / php-src", "range": "< 8.4.16（修正版 8.4.16 に対応する系列。旧系列の影響は原文確認）" }, { "product": "PHP 8.5系 / php-src", "range": "< 8.5.1（修正版 8.5.1 に対応する系列。旧系列の影響は原文確認）" } ], "fixed": [ "8.1.34", "8.2.30", "8.3.29", "8.4.16", "8.5.1" ], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "label": "PHP Security：The PHP Group" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-www2-q4fc-65wf", "label": "PHP開発元のアドバイザリ" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-12-18T16:11:09.000Z", "modifiedAt": "2025-12-18T16:11:09.000Z", "fetchedAt": "2026-10-23T02:57:44.503Z", "exploitStatus": "unknown", "sources": [ "PHP Security" ], "originalText": "As GHSA-3cr5-j632-f35r, same null termination is occuring", "sourceTitle": "Null byte termination in dns_get_record()", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "officialEvidence": { "schemaVersion": "1.0", "id": "GHSA-www2-q4fc-65wf", "advisoryId": "GHSA-www2-q4fc-65wf", "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "fetchedAt": "2026-10-23T02:57:44.503Z", "publishedAt": "2025-12-18T16:11:09.000Z", "modifiedAt": "2025-12-18T16:11:09.000Z", "state": "published", "provider": "The PHP Group", "title": "Null byte termination in dns_get_record()", "descriptions": [ { "lang": "en", "value": "### Summary\r\n\r\nAs GHSA-3cr5-j632-f35r, same null termination is occuring\n\n### Details\r\n\r\ndns_get_record() and other DNS functions don't have any null contain check, leads potential SSRF or unexpected behavior.\n\n### Security impact\r\n\r\n(Even though it's too low but,) Probability of SSRF", "sourcePath": "/description", "representation": "defensive_sections" } ], "affected": [ { "vendor": "The PHP Group", "product": "PHP", "packageName": "php-src", "sourcePath": "/vulnerabilities/0", "vulnerableVersionRange": "< 8.1.34", "patchedVersions": "8.1.34", "versions": [], "platforms": [], "modules": [], "programFiles": [], "programRoutines": [], "cpes": [] }, { "vendor": "The PHP Group", "product": "PHP", "packageName": "php-src", "sourcePath": "/vulnerabilities/1", "vulnerableVersionRange": "< 8.2.30", "patchedVersions": "8.2.30", "versions": [], "platforms": [], "modules": [], "programFiles": [], "programRoutines": [], "cpes": [] }, { "vendor": "The PHP Group", "product": "PHP", "packageName": "php-src", "sourcePath": "/vulnerabilities/2", "vulnerableVersionRange": "< 8.3.29", "patchedVersions": "8.3.29", "versions": [], "platforms": [], "modules": [], "programFiles": [], "programRoutines": [], "cpes": [] }, { "vendor": "The PHP Group", "product": "PHP", "packageName": "php-src", "sourcePath": "/vulnerabilities/3", "vulnerableVersionRange": "< 8.4.16", "patchedVersions": "8.4.16", "versions": [], "platforms": [], "modules": [], "programFiles": [], "programRoutines": [], "cpes": [] }, { "vendor": "The PHP Group", "product": "PHP", "packageName": "php-src", "sourcePath": "/vulnerabilities/4", "vulnerableVersionRange": "< 8.5.1", "patchedVersions": "8.5.1", "versions": [], "platforms": [], "modules": [], "programFiles": [], "programRoutines": [], "cpes": [] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.34; patched versions: 8.1.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.30; patched versions: 8.2.30", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.29; patched versions: 8.3.29", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.16; patched versions: 8.4.16", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.5.1; patched versions: 8.5.1", "sourcePath": "/vulnerabilities/4/patched_versions", "representation": "structured_field_summary" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-www2-q4fc-65wf", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "sourcePath": "/description", "text": "### Summary\r\n\r\nAs GHSA-3cr5-j632-f35r, same null termination is occuring\n\n### Details\r\n\r\ndns_get_record() and other DNS functions don't have any null contain check, leads potential SSRF or unexpected behavior.\n\n### Security impact\r\n\r\n(Even though it's too low but,) Probability of SSRF", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "official:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.34\",\"patched_versions\":\"8.1.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.30\",\"patched_versions\":\"8.2.30\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.29\",\"patched_versions\":\"8.3.29\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.16\",\"patched_versions\":\"8.4.16\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/vulnerabilities/4", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "sourcePath": "/vulnerabilities/4", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.5.1\",\"patched_versions\":\"8.5.1\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } }, "sourceSnapshots": [ { "source": "PHP Security", "modifiedAt": "2025-12-18T16:11:09.000Z", "fetchedAt": "2026-10-23T02:57:44.503Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2025-12-18T16:11:09.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:22.128Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "1d4dc93467a8d5bf08b2df20d51fa5d40db43dc6f8085a2d44a1a9f93e3a1902", "sourceModifiedAt": "2025-12-18T16:11:09.000Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "GHSA-3cr5-j632-f35r と同様に、null バイトで文字列が終端される問題が発生します。dns_get_record() などの DNS 関数は null のチェックを行わないため、サーバー側リクエスト偽装（SSRF）や予期しない動作が起こる可能性があります。", "risk": "サーバー側リクエスト偽装（SSRF）が発生する可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.1 系はバージョン 8.1.34 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.2 系はバージョン 8.2.30 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP 8.3 系はバージョン 8.3.29 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "PHP 8.4 系はバージョン 8.4.16 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "PHP 8.5 系はバージョン 8.5.1 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf" ], "evidenceIds": [ "E7", "E2" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf" ], "evidenceIds": [ "E2" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-www2-q4fc-65wf" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf" ], "evidenceIds": [ "E2" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "label": "PHP Security：The PHP Group" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-www2-q4fc-65wf", "label": "PHP開発元のアドバイザリ" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "sourceField": "/description", "excerpt": "### Summary\r\n\r\nAs GHSA-3cr5-j632-f35r, same null termination is occuring\n\n### Details\r\n\r\ndns_get_record() and other DNS functions don't have any null contain check, leads potential SSRF or unexpected behavior.\n\n### Security impact\r\n\r\n(Even though it's too low but,) Probability of SSRF", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "sourceField": "/title", "excerpt": "Null byte termination in dns_get_record()", "language": null }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "sourceField": "/vulnerabilities/0", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.34\",\"patched_versions\":\"8.1.34\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "sourceField": "/vulnerabilities/1", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.30\",\"patched_versions\":\"8.2.30\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "sourceField": "/vulnerabilities/2", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.29\",\"patched_versions\":\"8.3.29\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "sourceField": "/vulnerabilities/3", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.16\",\"patched_versions\":\"8.4.16\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-www2-q4fc-65wf", "sourceField": "/vulnerabilities/4", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.5.1\",\"patched_versions\":\"8.5.1\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：GHSA-www2-q4fc-65wf（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1 系はバージョン 8.1.34 未満が影響を受けます。\n・PHP 8.2 系はバージョン 8.2.30 未満が影響を受けます。\n・PHP 8.3 系はバージョン 8.3.29 未満が影響を受けます。\n・PHP 8.4 系はバージョン 8.4.16 未満が影響を受けます。\n・PHP 8.5 系はバージョン 8.5.1 未満が影響を受けます。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/GHSA-www2-q4fc-65wf", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:22.128Z", "lastSuccess": "2026-10-23T03:25:22.128Z", "sourceCheckedAt": "2026-10-23T02:57:44.503Z", "errorCode": null }, "glossary": [ { "term": "SSRF", "meaning": "攻撃者が、サーバーに意図しない宛先へ通信を送らせる問題です。実際に送れる通信や影響の範囲は、それぞれの脆弱性の説明で確認します。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF", "kind": "general_definition" } ] } }, { "id": "CVE-2025-14180", "aliases": [ "GHSA-8xr5-qppj-gvwj" ], "title": "PHP：脆弱性情報", "summary": "PHP のバージョン 8.1.*（8.1.34 未満）、8.2.*（8.2.30 未満）、8.3.*（8.3.29 未満）、8.4.*（8.4.16 未満）、8.5.*（8.5.1 未満）で、PDO の PostgreSQL ドライバを使用し、PDO::ATTR_EMULATE_PREPARES を有効にした状態で、\\x99 などの無効な文字列をパラメータに含めると、内部の PQescapeStringConn 関数が NULL を返し、pdo_parse_params() が NULL ポインタを参照してクラッシュ（セグメンテーションフォルト）し、サーバーの可用性が失われる可能性があります。", "risk": "この問題によりサーバーがクラッシュし、サービスが利用できなくなる（DoS）可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "high", "cvss": 8.2, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.34" }, { "product": "PHP", "range": "8.2.* / < 8.2.30" }, { "product": "PHP", "range": "8.3.* / < 8.3.29" }, { "product": "PHP", "range": "8.4.* / < 8.4.16" }, { "product": "PHP", "range": "8.5.* / < 8.5.1" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.1.34", "8.2.30", "8.3.29", "8.4.16", "8.5.1" ], "steps": [ "PHP を 8.1.34、8.2.30、8.3.29、8.4.16、8.5.1 以降のバージョンにアップデートしてください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14180", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-12-18T16:10:58.000Z", "modifiedAt": "2025-12-29T16:00:11.239Z", "fetchedAt": "2026-10-23T02:43:35.496Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \\x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.", "sourceTitle": "NULL Pointer Dereference in PDO quoting", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "packageName": "pdo", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.34", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.30", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.29", "status": "affected", "version": "8.3.*", "versionType": "semver" }, { "lessThan": "8.4.16", "status": "affected", "version": "8.4.*", "versionType": "semver" }, { "lessThan": "8.5.1", "status": "affected", "version": "8.5.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-14180", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json", "fetchedAt": "2026-10-23T02:43:35.496Z", "publishedAt": "2025-12-27T19:21:20.768Z", "modifiedAt": "2025-12-29T16:00:11.239Z", "state": "published", "provider": "php", "title": "NULL Pointer Dereference in PDO quoting", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \\x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "**Product:** PHP\r\n**Version:** 8.5.0-DEV (CLI)\r\n**CWE-ID:** CWE-476: NULL Pointer Dereference\r\n**CVSS vector v.4.0:** 8.2 (AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)\r\n**Description:** A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.\r\n**Exploitation conditions:** An unauthorized user\r\n**Mitigation:** Explicitly check whether a NULL pointer exists before dereferencing it.\r\n**Researcher:** Aleksey Solovev (Positive Technologies)\n\n## Research\r\n\r\nThe vulnerable source code is the `ZSTR_LEN(plc->quoted)` macro call in the `pdo_parse_params` function in `php-src/ext/pdo/pdo_sql_parser.re`. Inside the `ZSTR_LEN(plc->quoted)` macro, the `len` field is accessed.\r\n\r\n_Figure 1. The `ZSTR_LEN` macro_\r\n\"image\"\r\n\r\n\r\nHowever, when using a special character sequence, `plc->quoted` is equal to `0x0`.\r\n\r\n_Figure 2. The vulnerable source code_\r\n\"image\"\r\n\r\nThe `plc->quoted` field is generated in this case on line 302 when calling the `stmt->dbh->methods->quoter` function.\r\n\r\n_Figure 3. `plc->quoted` initialization_\r\n\"image\"\r\n\r\nWhen calling `stmt->dbh->methods->quoter`, the quoting function `pgsql_handle_quoter` for PG will be called. On line 407, it will call the PG library function `PQescapeStringConn`, which will return an error when processing the special sequence, returning NULL as a result. This result will be assigned to the `plc->quoted` field.\r\n\r\n_Figure 4. Returning NULL when error occurs_\r\n\"image\"\n\n## Vulnerability reproduction\r\n\r\nThe PHP language was compiled using the following commands.\r\n\r\n_Listing 1. Compiling PHP_\r\n\r\n\r\nNext, the following PHP code was placed on the server, causing to `Segmentation fault`.\r\nEnabling the `PDO::ATTR_EMULATE_PREPARES` mode is the key element of this code. \r\nThe problem is caused by a non-existent sequence of characters in hexadecimal notation, for example `\\x99`.\r\n\r\n_Listing 2. Source code on the server_\r\n\r\n\r\nExecuting the following PHP code results in `Segmentation fault`, which leads to Denial of Service (DoS).\r\n\r\n_Figure 5. Demonstration of the vulnerability_\r\n\"image\"\n\n## Security impact\r\n\r\nIf there is no extra validaiton for zero byte of the quoted user input, then it could lead to a potential DoS and for ZTS mode stopping all other currently served requests in the process.\n\n## Credits\r\nAleksey Solovev (Positive Technologies)", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-8xr5-qppj-gvwj" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "pdo", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.30", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.29", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.4.*", "lessThan": "8.4.16", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "8.5.*", "lessThan": "8.5.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.34; patched versions: 8.1.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-8xr5-qppj-gvwj" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.30; patched versions: 8.2.30", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-8xr5-qppj-gvwj" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.29; patched versions: 8.3.29", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-8xr5-qppj-gvwj" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.16; patched versions: 8.4.16", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-8xr5-qppj-gvwj" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.5.1; patched versions: 8.5.1", "sourcePath": "/vulnerabilities/4/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-8xr5-qppj-gvwj" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-476", "lang": "en", "description": "CWE-476 NULL Pointer Dereference", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.2, "baseSeverity": "HIGH", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"packageName\":\"pdo\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.34\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.30\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.29\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.16\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.5.1\",\"status\":\"affected\",\"version\":\"8.5.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \\x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-476\",\"description\":\"CWE-476 NULL Pointer Dereference\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"attackVector\":\"NETWORK\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"HIGH\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-8xr5-qppj-gvwj:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-8xr5-qppj-gvwj", "sourcePath": "/description", "text": "**Product:** PHP\r\n**Version:** 8.5.0-DEV (CLI)\r\n**CWE-ID:** CWE-476: NULL Pointer Dereference\r\n**CVSS vector v.4.0:** 8.2 (AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)\r\n**Description:** A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.\r\n**Exploitation conditions:** An unauthorized user\r\n**Mitigation:** Explicitly check whether a NULL pointer exists before dereferencing it.\r\n**Researcher:** Aleksey Solovev (Positive Technologies)\n\n## Research\r\n\r\nThe vulnerable source code is the `ZSTR_LEN(plc->quoted)` macro call in the `pdo_parse_params` function in `php-src/ext/pdo/pdo_sql_parser.re`. Inside the `ZSTR_LEN(plc->quoted)` macro, the `len` field is accessed.\r\n\r\n_Figure 1. The `ZSTR_LEN` macro_\r\n\"image\"\r\n\r\n\r\nHowever, when using a special character sequence, `plc->quoted` is equal to `0x0`.\r\n\r\n_Figure 2. The vulnerable source code_\r\n\"image\"\r\n\r\nThe `plc->quoted` field is generated in this case on line 302 when calling the `stmt->dbh->methods->quoter` function.\r\n\r\n_Figure 3. `plc->quoted` initialization_\r\n\"image\"\r\n\r\nWhen calling `stmt->dbh->methods->quoter`, the quoting function `pgsql_handle_quoter` for PG will be called. On line 407, it will call the PG library function `PQescapeStringConn`, which will return an error when processing the special sequence, returning NULL as a result. This result will be assigned to the `plc->quoted` field.\r\n\r\n_Figure 4. Returning NULL when error occurs_\r\n\"image\"\n\n## Vulnerability reproduction\r\n\r\nThe PHP language was compiled using the following commands.\r\n\r\n_Listing 1. Compiling PHP_\r\n\r\n\r\nNext, the following PHP code was placed on the server, causing to `Segmentation fault`.\r\nEnabling the `PDO::ATTR_EMULATE_PREPARES` mode is the key element of this code. \r\nThe problem is caused by a non-existent sequence of characters in hexadecimal notation, for example `\\x99`.\r\n\r\n_Listing 2. Source code on the server_\r\n\r\n\r\nExecuting the following PHP code results in `Segmentation fault`, which leads to Denial of Service (DoS).\r\n\r\n_Figure 5. Demonstration of the vulnerability_\r\n\"image\"\n\n## Security impact\r\n\r\nIf there is no extra validaiton for zero byte of the quoted user input, then it could lead to a potential DoS and for ZTS mode stopping all other currently served requests in the process.\n\n## Credits\r\nAleksey Solovev (Positive Technologies)", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-8xr5-qppj-gvwj:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-8xr5-qppj-gvwj", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.34\",\"patched_versions\":\"8.1.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-8xr5-qppj-gvwj:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-8xr5-qppj-gvwj", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.30\",\"patched_versions\":\"8.2.30\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-8xr5-qppj-gvwj:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-8xr5-qppj-gvwj", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.29\",\"patched_versions\":\"8.3.29\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-8xr5-qppj-gvwj:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-8xr5-qppj-gvwj", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.16\",\"patched_versions\":\"8.4.16\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-8xr5-qppj-gvwj:/vulnerabilities/4", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-8xr5-qppj-gvwj", "sourcePath": "/vulnerabilities/4", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.5.1\",\"patched_versions\":\"8.5.1\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-12-29T16:00:11.239Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-8xr5-qppj-gvwj", "modifiedAt": "2025-12-18T16:10:58.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-12-29T16:00:11.239Z", "fetchedAt": "2026-10-23T02:43:35.496Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2025-12-18T16:10:58.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:22.250Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "bd24628a52e7a92373f7b57512b60041ba2c9f4217fd19235e236c94ccfe718b", "sourceModifiedAt": "2025-12-29T16:00:11.239Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP のバージョン 8.1.*（8.1.34 未満）、8.2.*（8.2.30 未満）、8.3.*（8.3.29 未満）、8.4.*（8.4.16 未満）、8.5.*（8.5.1 未満）で、PDO の PostgreSQL ドライバを使用し、PDO::ATTR_EMULATE_PREPARES を有効にした状態で、\\x99 などの無効な文字列をパラメータに含めると、内部の PQescapeStringConn 関数が NULL を返し、pdo_parse_params() が NULL ポインタを参照してクラッシュ（セグメンテーションフォルト）し、サーバーの可用性が失われる可能性があります。", "risk": "この問題によりサーバーがクラッシュし、サービスが利用できなくなる（DoS）可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.1.*（8.1.34 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.2.*（8.2.30 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.3.*（8.3.29 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.4.*（8.4.16 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.5.*（8.5.1 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PDO PostgreSQL ドライバを使用し、PDO::ATTR_EMULATE_PREPARES を有効にした場合にのみこの脆弱性が発生します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.34未満。影響ありとして記載：8.2系のうち、8.2.30未満。影響ありとして記載：8.3系のうち、8.3.29未満。影響ありとして記載：8.4系のうち、8.4.16未満。影響ありとして記載：8.5系のうち、8.5.1未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.1.34、8.2.30、8.3.29、8.4.16、8.5.1 以降のバージョンにアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj" ], "evidenceIds": [ "E4" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-14180", "https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14180", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \\x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json", "sourceField": "/containers/cna/title", "excerpt": "NULL Pointer Dereference in PDO quoting", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14180.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"packageName\":\"pdo\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.34\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.30\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.29\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.16\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.5.1\",\"status\":\"affected\",\"version\":\"8.5.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj", "sourceField": "/fixed", "excerpt": "[\"8.1.34\",\"8.2.30\",\"8.3.29\",\"8.4.16\",\"8.5.1\"]", "language": null } ], "supportRequest": "件名：CVE-2025-14180（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1.*（8.1.34 未満）が影響を受けます。\n・PHP 8.2.*（8.2.30 未満）が影響を受けます。\n・PHP 8.3.*（8.3.29 未満）が影響を受けます。\n・PHP 8.4.*（8.4.16 未満）が影響を受けます。\n・PHP 8.5.*（8.5.1 未満）が影響を受けます。\n・PDO PostgreSQL ドライバを使用し、PDO::ATTR_EMULATE_PREPARES を有効にした場合にのみこの脆弱性が発生します。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.34未満。影響ありとして記載：8.2系のうち、8.2.30未満。影響ありとして記載：8.3系のうち、8.3.29未満。影響ありとして記載：8.4系のうち、8.4.16未満。影響ありとして記載：8.5系のうち、8.5.1未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-14180", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:22.250Z", "lastSuccess": "2026-10-23T03:25:22.250Z", "sourceCheckedAt": "2026-10-23T02:43:35.496Z", "errorCode": null }, "glossary": [ { "term": "サービス拒否（DoS）", "meaning": "サービスや機能が停止したり、処理が遅くなったりして、通常どおり利用できなくなることです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/400.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-14178", "aliases": [ "GHSA-h96m-rvf9-jgm2" ], "title": "PHP：脆弱性情報", "summary": "PHP のバージョン 8.1.*（8.1.34 未満）、8.2.*（8.2.30 未満）、8.3.*（8.3.29 未満）、8.4.*（8.4.16 未満）、8.5.*（8.5.1 未満）において、array_merge() がパックド配列の要素総数が 32 ビット上限または HT_MAX_SIZE を超えると、zend_hash_num_elements() による要素数の事前計算で整数オーバーフローが起き、ヒープバッファオーバーフローが発生します。この結果、メモリ破壊やクラッシュが起こり、対象サーバーの整合性と可用性に影響します。", "risk": "メモリ破壊やクラッシュが発生し、サーバーの整合性と可用性が損なわれる可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.34" }, { "product": "PHP", "range": "8.2.* / < 8.2.30" }, { "product": "PHP", "range": "8.3.* / < 8.3.29" }, { "product": "PHP", "range": "8.4.* / < 8.4.16" }, { "product": "PHP", "range": "8.5.* / < 8.5.1" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.1.34", "8.2.30", "8.3.29", "8.4.16", "8.5.1" ], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14178", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-12-18T16:10:32.000Z", "modifiedAt": "2026-01-24T11:04:01.892Z", "fetchedAt": "2026-10-23T02:43:35.399Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.", "sourceTitle": "Heap buffer overflow in array_merge()", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "packageName": "php", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.34", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.30", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.29", "status": "affected", "version": "8.3.*", "versionType": "semver" }, { "lessThan": "8.4.16", "status": "affected", "version": "8.4.*", "versionType": "semver" }, { "lessThan": "8.5.1", "status": "affected", "version": "8.5.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-14178", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json", "fetchedAt": "2026-10-23T02:43:35.399Z", "publishedAt": "2025-12-27T19:27:41.691Z", "modifiedAt": "2026-01-24T11:04:01.892Z", "state": "published", "provider": "php", "title": "Heap buffer overflow in array_merge()", "descriptions": [ { "lang": "en", "value": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "The following PHP code triggers a reliable heap buffer overflow:\r\n\r\n\r\nOr the general case:\r\n\r\n\r\nThis is because packed arrays in array_merge() have an optimization that requires precomputing the count of the elements, done using `count += zend_hash_num_elements(Z_ARRVAL_P(arg));`. However, this may overflow. Note that even if it didn't, it would cause a DoS because array_init() will trigger a bailout with too large counts.\r\n\r\nThe code provided is artificial, but I believe this can happen in the real world with for example large sets of JSON data that are then passed to array_merge(). The total count just has to exceed HT_MAX_SIZE to trigger the DoS or the 32-bit limit to trigger the buffer overflow.\n\n### Impact\r\n\r\nIf we were using a memory safe language we would \"just\" be limited to the DoS, but now we have heap corruption and all the joys of it.\r\nThis bug has been in PHP since PHP 7.1.\n\n### Workarounds\r\nPrevent a large number of inputs of long arrays to array_merge().\n\n### Security impact\r\n\r\nAs noted the example code is just a PoC exploit trigger.\r\n\r\nThe JSON file could be crafted and loaded via json_decode that results in a structure like: [array1, array2, array3, ...]. Then the code could use `array_merge(array1, array2, array3, ...)` from the JSON data. The arrays itself may be relatively small but if the sum of elements exceed the HT_MAX_SIZE bound, the buffer overflow is triggered.\r\n\r\nSomething like this:", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "php", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.30", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.29", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.4.*", "lessThan": "8.4.16", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "8.5.*", "lessThan": "8.5.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.34; patched versions: 8.1.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.30; patched versions: 8.2.30", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.29; patched versions: 8.3.29", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.16; patched versions: 8.4.16", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.5.1; patched versions: 8.5.1", "sourcePath": "/vulnerabilities/4/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-190", "lang": "en", "description": "CWE-190 Integer Overflow or Wraparound", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00019.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"packageName\":\"php\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.34\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.30\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.29\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.16\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.5.1\",\"status\":\"affected\",\"version\":\"8.5.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-787\",\"description\":\"CWE-787 Out-of-bounds Write\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"cweId\":\"CWE-190\",\"description\":\"CWE-190 Integer Overflow or Wraparound\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-h96m-rvf9-jgm2:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2", "sourcePath": "/description", "text": "The following PHP code triggers a reliable heap buffer overflow:\r\n\r\n\r\nOr the general case:\r\n\r\n\r\nThis is because packed arrays in array_merge() have an optimization that requires precomputing the count of the elements, done using `count += zend_hash_num_elements(Z_ARRVAL_P(arg));`. However, this may overflow. Note that even if it didn't, it would cause a DoS because array_init() will trigger a bailout with too large counts.\r\n\r\nThe code provided is artificial, but I believe this can happen in the real world with for example large sets of JSON data that are then passed to array_merge(). The total count just has to exceed HT_MAX_SIZE to trigger the DoS or the 32-bit limit to trigger the buffer overflow.\n\n### Impact\r\n\r\nIf we were using a memory safe language we would \"just\" be limited to the DoS, but now we have heap corruption and all the joys of it.\r\nThis bug has been in PHP since PHP 7.1.\n\n### Workarounds\r\nPrevent a large number of inputs of long arrays to array_merge().\n\n### Security impact\r\n\r\nAs noted the example code is just a PoC exploit trigger.\r\n\r\nThe JSON file could be crafted and loaded via json_decode that results in a structure like: [array1, array2, array3, ...]. Then the code could use `array_merge(array1, array2, array3, ...)` from the JSON data. The arrays itself may be relatively small but if the sum of elements exceed the HT_MAX_SIZE bound, the buffer overflow is triggered.\r\n\r\nSomething like this:", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-h96m-rvf9-jgm2:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.34\",\"patched_versions\":\"8.1.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-h96m-rvf9-jgm2:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.30\",\"patched_versions\":\"8.2.30\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-h96m-rvf9-jgm2:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.29\",\"patched_versions\":\"8.3.29\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-h96m-rvf9-jgm2:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.16\",\"patched_versions\":\"8.4.16\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-h96m-rvf9-jgm2:/vulnerabilities/4", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2", "sourcePath": "/vulnerabilities/4", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.5.1\",\"patched_versions\":\"8.5.1\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-01-24T11:04:01.892Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2", "modifiedAt": "2025-12-19T09:47:08.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-01-24T11:04:01.892Z", "fetchedAt": "2026-10-23T02:43:35.399Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2025-12-19T09:47:08.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:23.160Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "dcc3eafaab35661d7b0f1bb45923a125cf9cead25313eb459e9665df20a2c3df", "sourceModifiedAt": "2026-01-24T11:04:01.892Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP のバージョン 8.1.*（8.1.34 未満）、8.2.*（8.2.30 未満）、8.3.*（8.3.29 未満）、8.4.*（8.4.16 未満）、8.5.*（8.5.1 未満）において、array_merge() がパックド配列の要素総数が 32 ビット上限または HT_MAX_SIZE を超えると、zend_hash_num_elements() による要素数の事前計算で整数オーバーフローが起き、ヒープバッファオーバーフローが発生します。この結果、メモリ破壊やクラッシュが起こり、対象サーバーの整合性と可用性に影響します。", "risk": "メモリ破壊やクラッシュが発生し、サーバーの整合性と可用性が損なわれる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP バージョン 8.1.*（8.1.34 未満）、8.2.*（8.2.30 未満）、8.3.*（8.3.29 未満）、8.4.*（8.4.16 未満）、8.5.*（8.5.1 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "array_merge() がパックド配列の要素総数が 32 ビット上限または HT_MAX_SIZE を超えると脆弱性が発生します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "脆弱性の原因は、zend_hash_num_elements() を用いた要素数の事前計算で整数オーバーフローが起きることです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "このバグは PHP 7.1 以降に存在しています。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.34未満。影響ありとして記載：8.2系のうち、8.2.30未満。影響ありとして記載：8.3系のうち、8.3.29未満。影響ありとして記載：8.4系のうち、8.4.16未満。影響ありとして記載：8.5系のうち、8.5.1未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-14178", "https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14178", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json", "sourceField": "/containers/cna/title", "excerpt": "Heap buffer overflow in array_merge()", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14178.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"packageName\":\"php\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.34\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.30\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.29\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.16\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.5.1\",\"status\":\"affected\",\"version\":\"8.5.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-h96m-rvf9-jgm2", "sourceField": "/description", "excerpt": "The following PHP code triggers a reliable heap buffer overflow:\r\n\r\n\r\nOr the general case:\r\n\r\n\r\nThis is because packed arrays in array_merge() have an optimization that requires precomputing the count of the elements, done using `count += zend_hash_num_elements(Z_ARRVAL_P(arg));`. However, this may overflow. Note that even if it didn't, it would cause a DoS because array_init() will trigger a bailout with too large counts.\r\n\r\nThe code provided is artificial, but I believe this can happen in the real world with for example large sets of JSON data that are then passed to array_merge(). The total count just has to exceed HT_MAX_SIZE to trigger the DoS or the 32-bit limit to trigger the buffer overflow.\n\n### Impact\r\n\r\nIf we were using a memory safe language we would \"just\" be limited to the DoS, but now we have heap corruption and all the joys of it.\r\nThis bug has been in PHP since PHP 7.1.\n\n### Workarounds\r\nPrevent a large number of inputs of long arrays to array_merge().\n\n### Security impact\r\n\r\nAs noted the example code is just a PoC exploit trigger.\r\n\r\nThe JSON file could be crafted and loaded via json_decode that results in a structure like: [array1, array2, array3, ...]. Then the code could use `array_merge(array1, array2, array3, ...)` from the JSON data. The arrays itself may be relatively small but if the sum of elements exceed the HT_MAX_SIZE bound, the buffer overflow is triggered.\r\n\r\nSomething like this:", "language": "en", "representation": "defensive_sections", "filtered": true } ], "supportRequest": "件名：CVE-2025-14178（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP バージョン 8.1.*（8.1.34 未満）、8.2.*（8.2.30 未満）、8.3.*（8.3.29 未満）、8.4.*（8.4.16 未満）、8.5.*（8.5.1 未満）が影響を受けます。\n・array_merge() がパックド配列の要素総数が 32 ビット上限または HT_MAX_SIZE を超えると脆弱性が発生します。\n・脆弱性の原因は、zend_hash_num_elements() を用いた要素数の事前計算で整数オーバーフローが起きることです。\n・このバグは PHP 7.1 以降に存在しています。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.34未満。影響ありとして記載：8.2系のうち、8.2.30未満。影響ありとして記載：8.3系のうち、8.3.29未満。影響ありとして記載：8.4系のうち、8.4.16未満。影響ありとして記載：8.5系のうち、8.5.1未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-14178", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:23.160Z", "lastSuccess": "2026-10-23T03:25:23.160Z", "sourceCheckedAt": "2026-10-23T02:43:35.399Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-14177", "aliases": [ "GHSA-3237-qqm7-mfv7" ], "title": "PHP：情報の漏えい", "summary": "PHP の getimagesize() 関数は、画像をマルチチャンクモード（例: php://filter を介して）で読み込む際に、php_read_stream_all_chunks() のバグによりバッファのポインタが進まず、末尾のバイトが未初期化のまま残ります。その結果、APPn セグメント（例: APP1）に未初期化ヒープメモリが漏れ出す可能性があります。この問題は、PHP バージョン 8.1.*（8.1.34 未満）、8.2.*（8.2.30 未満）、8.3.*（8.3.29 未満）、8.4.*（8.4.16 未満）、8.5.*（8.5.1 未満）で発生します。", "risk": "未初期化ヒープメモリが漏れることで、サーバー上の機密データが外部に開示され、対象サーバーの機密性が損なわれる可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.3, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.34" }, { "product": "PHP", "range": "8.2.* / < 8.2.30" }, { "product": "PHP", "range": "8.3.* / < 8.3.29" }, { "product": "PHP", "range": "8.4.* / < 8.4.16" }, { "product": "PHP", "range": "8.5.* / < 8.5.1" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.1.34", "8.2.30", "8.3.29", "8.4.16", "8.5.1" ], "steps": [ "PHP 8.1.34、8.2.30、8.3.29、8.4.16、8.5.1 にアップデートして修正を適用してください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14177", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-12-18T16:10:22.000Z", "modifiedAt": "2025-12-30T22:41:58.000Z", "fetchedAt": "2026-10-23T02:43:35.398Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.", "sourceTitle": "Information Leak of Memory in getimagesize", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "packageName": "php", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.34", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.30", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.29", "status": "affected", "version": "8.3.*", "versionType": "semver" }, { "lessThan": "8.4.16", "status": "affected", "version": "8.4.*", "versionType": "semver" }, { "lessThan": "8.5.1", "status": "affected", "version": "8.5.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-14177", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json", "fetchedAt": "2026-10-23T02:43:35.398Z", "publishedAt": "2025-12-27T19:33:23.973Z", "modifiedAt": "2025-12-30T22:41:58.000Z", "state": "published", "provider": "php", "title": "Information Leak of Memory in getimagesize", "descriptions": [ { "lang": "en", "value": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "# Information Leak of Memory\r\nProduct: PHP EXT/STANDARD\r\nVersion: 8.6.0\r\nCWE-ID:\r\n•\t[CWE-524: Use of Cache Containing Sensitive Information](https://cwe.mitre.org/data/definitions/524.html)\r\n•\t[CAPEC-204: Lifting Sensitive Data Embedded in Cache](https://capec.mitre.org/data/definitions/204.html)\r\nCVSS vector v.4.0: 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)\r\nDescription: The application insufficiently controls access to information processed by the application data caching tool. As a result, an attacker can gain access to cached data.\r\nMitigation: Restrict access to information processed by the application data caching tool. Additionally, avoid caching information when unnecessary and, where possible, ensure cache encryption.\r\n\r\n**Researcher: Nikita Sveshnikov (Positive Technologies)**\n\n## Research \r\nResearcher discovered zero-day vulnerability «Information Leak of Memory» in PHP EXT/STANDARD.\r\nThis report includes a minimal proof‑of‑concept that demonstrates a bug in php-src/ext/standard/image.c where APPn data read for getimagesize(..., $info) may be corrupted and contain uninitialized heap bytes.\r\npoc.php is a minimal Proof of Concept (Listing 1). Writes a small JPEG (min.jpg), reads it through php://filter to force multi‑chunk reads and prints a human‑readable verdict with an inline leak marker snippet when found.\n\n### Vulnerability reproduction \r\n\r\nThe steps below outline the vulnerability reproduction.\r\n•\tUse the last PHP cli: ./php8.5.1 poc.php\r\n•\tOutput shows:\r\n - Expected/actual APP1 length\r\n - Expected vs returned APP1 head (hex)\r\n - Result: VULNERABLE … or Result: OK …\r\n - If vulnerable: Leak marker found: offset=… and a short ASCII/HEX snippet with the marker highlighted in [].\r\nNote, the issue triggers under multi‑chunk reads. Reading directly from file or from a string often returns in one read and may not reproduce. The PoC uses php://filter/... specifically to ensure chunked reading.\n\n### Vulnerability analysis\r\n\r\nphp_read_stream_all_chunks() writes every chunk into the start of the buffer without advancing the destination pointer. The function then reports success as if the full buffer were filled, so the tail may contain uninitialized memory and the head is overwritten by the last chunk. That buffer is stored into $info['APPn'].\r\n\r\nListing 1. PoC Source Code\r\n\r\n\r\n\"image\"\r\nFigure 1.\n\n## Security impact\r\n\r\nThis issue was originally not classified as a security issue due to usage of stream filter in recreation of the issue and the fact that only realy image file is supposed to be used. However, after deeper investigation during the fix, it was discovered that this can be exploitable if attacker knows the stream chunk size (which is mostly default) even on normal image. Such attack would be more complex but possible.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3237-qqm7-mfv7" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "php", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.30", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.29", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.4.*", "lessThan": "8.4.16", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "8.5.*", "lessThan": "8.5.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.34; patched versions: 8.1.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3237-qqm7-mfv7" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.30; patched versions: 8.2.30", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3237-qqm7-mfv7" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.29; patched versions: 8.3.29", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3237-qqm7-mfv7" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.16; patched versions: 8.4.16", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3237-qqm7-mfv7" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.5.1; patched versions: 8.5.1", "sourcePath": "/vulnerabilities/4/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3237-qqm7-mfv7" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "baseScore": 6.3, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"packageName\":\"php\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.34\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.30\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.29\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.16\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.5.1\",\"status\":\"affected\",\"version\":\"8.5.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-125\",\"description\":\"CWE-125 Out-of-bounds Read\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"attackVector\":\"NETWORK\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"exploitMaturity\":\"NOT_DEFINED\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-3237-qqm7-mfv7:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3237-qqm7-mfv7", "sourcePath": "/description", "text": "# Information Leak of Memory\r\nProduct: PHP EXT/STANDARD\r\nVersion: 8.6.0\r\nCWE-ID:\r\n•\t[CWE-524: Use of Cache Containing Sensitive Information](https://cwe.mitre.org/data/definitions/524.html)\r\n•\t[CAPEC-204: Lifting Sensitive Data Embedded in Cache](https://capec.mitre.org/data/definitions/204.html)\r\nCVSS vector v.4.0: 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)\r\nDescription: The application insufficiently controls access to information processed by the application data caching tool. As a result, an attacker can gain access to cached data.\r\nMitigation: Restrict access to information processed by the application data caching tool. Additionally, avoid caching information when unnecessary and, where possible, ensure cache encryption.\r\n\r\n**Researcher: Nikita Sveshnikov (Positive Technologies)**\n\n## Research \r\nResearcher discovered zero-day vulnerability «Information Leak of Memory» in PHP EXT/STANDARD.\r\nThis report includes a minimal proof‑of‑concept that demonstrates a bug in php-src/ext/standard/image.c where APPn data read for getimagesize(..., $info) may be corrupted and contain uninitialized heap bytes.\r\npoc.php is a minimal Proof of Concept (Listing 1). Writes a small JPEG (min.jpg), reads it through php://filter to force multi‑chunk reads and prints a human‑readable verdict with an inline leak marker snippet when found.\n\n### Vulnerability reproduction \r\n\r\nThe steps below outline the vulnerability reproduction.\r\n•\tUse the last PHP cli: ./php8.5.1 poc.php\r\n•\tOutput shows:\r\n - Expected/actual APP1 length\r\n - Expected vs returned APP1 head (hex)\r\n - Result: VULNERABLE … or Result: OK …\r\n - If vulnerable: Leak marker found: offset=… and a short ASCII/HEX snippet with the marker highlighted in [].\r\nNote, the issue triggers under multi‑chunk reads. Reading directly from file or from a string often returns in one read and may not reproduce. The PoC uses php://filter/... specifically to ensure chunked reading.\n\n### Vulnerability analysis\r\n\r\nphp_read_stream_all_chunks() writes every chunk into the start of the buffer without advancing the destination pointer. The function then reports success as if the full buffer were filled, so the tail may contain uninitialized memory and the head is overwritten by the last chunk. That buffer is stored into $info['APPn'].\r\n\r\nListing 1. PoC Source Code\r\n\r\n\r\n\"image\"\r\nFigure 1.\n\n## Security impact\r\n\r\nThis issue was originally not classified as a security issue due to usage of stream filter in recreation of the issue and the fact that only realy image file is supposed to be used. However, after deeper investigation during the fix, it was discovered that this can be exploitable if attacker knows the stream chunk size (which is mostly default) even on normal image. Such attack would be more complex but possible.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-3237-qqm7-mfv7:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3237-qqm7-mfv7", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.34\",\"patched_versions\":\"8.1.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-3237-qqm7-mfv7:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3237-qqm7-mfv7", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.30\",\"patched_versions\":\"8.2.30\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-3237-qqm7-mfv7:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3237-qqm7-mfv7", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.29\",\"patched_versions\":\"8.3.29\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-3237-qqm7-mfv7:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3237-qqm7-mfv7", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.16\",\"patched_versions\":\"8.4.16\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-3237-qqm7-mfv7:/vulnerabilities/4", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3237-qqm7-mfv7", "sourcePath": "/vulnerabilities/4", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.5.1\",\"patched_versions\":\"8.5.1\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-12-29T16:01:36.231Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3237-qqm7-mfv7", "modifiedAt": "2025-12-30T22:41:58.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-12-29T16:01:36.231Z", "fetchedAt": "2026-10-23T02:43:35.398Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2025-12-30T22:41:58.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:23.467Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "98dfeb495654d3182dc60d94a39fb6d8f177f8f442e7665274688bc8e0b48a2e", "sourceModifiedAt": "2025-12-30T22:41:58.000Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP の getimagesize() 関数は、画像をマルチチャンクモード（例: php://filter を介して）で読み込む際に、php_read_stream_all_chunks() のバグによりバッファのポインタが進まず、末尾のバイトが未初期化のまま残ります。その結果、APPn セグメント（例: APP1）に未初期化ヒープメモリが漏れ出す可能性があります。この問題は、PHP バージョン 8.1.*（8.1.34 未満）、8.2.*（8.2.30 未満）、8.3.*（8.3.29 未満）、8.4.*（8.4.16 未満）、8.5.*（8.5.1 未満）で発生します。", "risk": "未初期化ヒープメモリが漏れることで、サーバー上の機密データが外部に開示され、対象サーバーの機密性が損なわれる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.1.*（8.1.34 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.2.*（8.2.30 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.3.*（8.3.29 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.4.*（8.4.16 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.5.*（8.5.1 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.34未満。影響ありとして記載：8.2系のうち、8.2.30未満。影響ありとして記載：8.3系のうち、8.3.29未満。影響ありとして記載：8.4系のうち、8.4.16未満。影響ありとして記載：8.5系のうち、8.5.1未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP 8.1.34、8.2.30、8.3.29、8.4.16、8.5.1 にアップデートして修正を適用してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7" ], "evidenceIds": [ "E4" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-14177", "https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14177", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json", "sourceField": "/containers/cna/title", "excerpt": "Information Leak of Memory in getimagesize", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14177.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"packageName\":\"php\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.34\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.30\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.29\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.16\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.5.1\",\"status\":\"affected\",\"version\":\"8.5.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7", "sourceField": "/fixed", "excerpt": "[\"8.1.34\",\"8.2.30\",\"8.3.29\",\"8.4.16\",\"8.5.1\"]", "language": null } ], "supportRequest": "件名：CVE-2025-14177（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1.*（8.1.34 未満）が影響を受けます。\n・PHP 8.2.*（8.2.30 未満）が影響を受けます。\n・PHP 8.3.*（8.3.29 未満）が影響を受けます。\n・PHP 8.4.*（8.4.16 未満）が影響を受けます。\n・PHP 8.5.*（8.5.1 未満）が影響を受けます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.34未満。影響ありとして記載：8.2系のうち、8.2.30未満。影響ありとして記載：8.3系のうち、8.3.29未満。影響ありとして記載：8.4系のうち、8.4.16未満。影響ありとして記載：8.5系のうち、8.5.1未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-14177", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:23.467Z", "lastSuccess": "2026-10-23T03:25:23.467Z", "sourceCheckedAt": "2026-10-23T02:43:35.398Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-20393", "aliases": [], "title": "Cisco Secure Email / Cisco Secure Email and Web Manager：コード実行", "summary": "Cisco Secure Email Gateway と Cisco Secure Email and Web Manager の Spam Quarantine 機能において、HTTP リクエストの検証が不十分なため、認証されていないリモート攻撃者が細工したリクエストを送るだけで、対象デバイス上で root 権限の任意コマンドを実行できる可能性があります。", "risk": "攻撃者が成功すると、対象デバイスの OS 上で root 権限で任意のコマンドが実行され、システム全体を支配される恐れがあります。", "product": "Cisco Secure Email / Cisco Secure Email and Web Manager", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Cisco Secure Email", "range": "14.0.0-698" }, { "product": "Cisco Secure Email", "range": "13.5.1-277" }, { "product": "Cisco Secure Email", "range": "13.0.0-392" }, { "product": "Cisco Secure Email", "range": "14.2.0-620" }, { "product": "Cisco Secure Email", "range": "13.0.5-007" }, { "product": "Cisco Secure Email", "range": "13.5.4-038" }, { "product": "Cisco Secure Email", "range": "14.2.1-020" }, { "product": "Cisco Secure Email", "range": "14.3.0-032" }, { "product": "Cisco Secure Email", "range": "15.0.0-104" }, { "product": "Cisco Secure Email", "range": "15.0.1-030" }, { "product": "Cisco Secure Email", "range": "15.5.0-048" }, { "product": "Cisco Secure Email", "range": "15.5.1-055" }, { "product": "Cisco Secure Email", "range": "15.5.2-018" }, { "product": "Cisco Secure Email", "range": "16.0.0-050" }, { "product": "Cisco Secure Email", "range": "15.0.3-002" }, { "product": "Cisco Secure Email", "range": "16.0.0-054" }, { "product": "Cisco Secure Email", "range": "15.5.3-022" }, { "product": "Cisco Secure Email", "range": "16.0.1-017" }, { "product": "Cisco Secure Email and Web Manager", "range": "13.6.2-023" }, { "product": "Cisco Secure Email and Web Manager", "range": "13.6.2-078" }, { "product": "Cisco Secure Email and Web Manager", "range": "13.0.0-249" }, { "product": "Cisco Secure Email and Web Manager", "range": "13.0.0-277" }, { "product": "Cisco Secure Email and Web Manager", "range": "13.8.1-052" }, { "product": "Cisco Secure Email and Web Manager", "range": "13.8.1-068" }, { "product": "Cisco Secure Email and Web Manager", "range": "13.8.1-074" }, { "product": "Cisco Secure Email and Web Manager", "range": "14.0.0-404" }, { "product": "Cisco Secure Email and Web Manager", "range": "12.8.1-002" }, { "product": "Cisco Secure Email and Web Manager", "range": "14.1.0-227" }, { "product": "Cisco Secure Email and Web Manager", "range": "13.6.1-201" }, { "product": "Cisco Secure Email and Web Manager", "range": "14.2.0-203" }, { "product": "Cisco Secure Email and Web Manager", "range": "14.2.0-212" }, { "product": "Cisco Secure Email and Web Manager", "range": "12.8.1-021" }, { "product": "Cisco Secure Email and Web Manager", "range": "13.8.1-108" }, { "product": "Cisco Secure Email and Web Manager", "range": "14.2.0-224" }, { "product": "Cisco Secure Email and Web Manager", "range": "14.3.0-120" }, { "product": "Cisco Secure Email and Web Manager", "range": "15.0.0-334" }, { "product": "Cisco Secure Email and Web Manager", "range": "15.5.1-024" }, { "product": "Cisco Secure Email and Web Manager", "range": "15.5.1-029" }, { "product": "Cisco Secure Email and Web Manager", "range": "15.5.2-005" }, { "product": "Cisco Secure Email and Web Manager", "range": "16.0.0-195" }, { "product": "Cisco Secure Email and Web Manager", "range": "15.5.3-017" }, { "product": "Cisco Secure Email and Web Manager", "range": "16.0.1-010" }, { "product": "Cisco Secure Email and Web Manager", "range": "15.0.1-035" }, { "product": "Cisco Secure Email and Web Manager", "range": "16.0.2-088" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-20393", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-20393", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20393", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-12-17T16:47:13.128Z", "modifiedAt": "2026-10-07T19:22:07.139Z", "fetchedAt": "2026-10-23T02:43:35.920Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.\r\n\r\nThis vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.", "sourceTitle": "Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "Cisco Secure Email", "versions": [ { "version": "14.0.0-698", "status": "affected" }, { "version": "13.5.1-277", "status": "affected" }, { "version": "13.0.0-392", "status": "affected" }, { "version": "14.2.0-620", "status": "affected" }, { "version": "13.0.5-007", "status": "affected" }, { "version": "13.5.4-038", "status": "affected" }, { "version": "14.2.1-020", "status": "affected" }, { "version": "14.3.0-032", "status": "affected" }, { "version": "15.0.0-104", "status": "affected" }, { "version": "15.0.1-030", "status": "affected" }, { "version": "15.5.0-048", "status": "affected" }, { "version": "15.5.1-055", "status": "affected" }, { "version": "15.5.2-018", "status": "affected" }, { "version": "16.0.0-050", "status": "affected" }, { "version": "15.0.3-002", "status": "affected" }, { "version": "16.0.0-054", "status": "affected" }, { "version": "15.5.3-022", "status": "affected" }, { "version": "16.0.1-017", "status": "affected" } ], "defaultStatus": "unknown" }, { "vendor": "Cisco", "product": "Cisco Secure Email and Web Manager", "versions": [ { "version": "13.6.2-023", "status": "affected" }, { "version": "13.6.2-078", "status": "affected" }, { "version": "13.0.0-249", "status": "affected" }, { "version": "13.0.0-277", "status": "affected" }, { "version": "13.8.1-052", "status": "affected" }, { "version": "13.8.1-068", "status": "affected" }, { "version": "13.8.1-074", "status": "affected" }, { "version": "14.0.0-404", "status": "affected" }, { "version": "12.8.1-002", "status": "affected" }, { "version": "14.1.0-227", "status": "affected" }, { "version": "13.6.1-201", "status": "affected" }, { "version": "14.2.0-203", "status": "affected" }, { "version": "14.2.0-212", "status": "affected" }, { "version": "12.8.1-021", "status": "affected" }, { "version": "13.8.1-108", "status": "affected" }, { "version": "14.2.0-224", "status": "affected" }, { "version": "14.3.0-120", "status": "affected" }, { "version": "15.0.0-334", "status": "affected" }, { "version": "15.5.1-024", "status": "affected" }, { "version": "15.5.1-029", "status": "affected" }, { "version": "15.5.2-005", "status": "affected" }, { "version": "16.0.0-195", "status": "affected" }, { "version": "15.5.3-017", "status": "affected" }, { "version": "16.0.1-010", "status": "affected" }, { "version": "15.0.1-035", "status": "affected" }, { "version": "16.0.2-088", "status": "affected" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-20393", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json", "fetchedAt": "2026-10-23T02:43:35.920Z", "publishedAt": "2025-12-17T16:47:13.128Z", "modifiedAt": "2026-10-07T19:22:07.139Z", "state": "published", "provider": "cisco", "title": "Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability", "descriptions": [ { "lang": "en", "value": "A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.\r\n\r\nThis vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Cisco", "product": "Cisco Secure Email", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "14.0.0-698", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "13.5.1-277", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "13.0.0-392", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "14.2.0-620", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "13.0.5-007", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "13.5.4-038", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "14.2.1-020", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "14.3.0-032", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "15.0.0-104", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "15.0.1-030", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "15.5.0-048", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "15.5.1-055", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "15.5.2-018", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "16.0.0-050", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "15.0.3-002", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "16.0.0-054", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "15.5.3-022", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "16.0.1-017", "status": "affected" } ] }, { "vendor": "Cisco", "product": "Cisco Secure Email and Web Manager", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "13.6.2-023", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "13.6.2-078", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "13.0.0-249", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "13.0.0-277", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "13.8.1-052", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": "13.8.1-068", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": "13.8.1-074", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/7", "version": "14.0.0-404", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/8", "version": "12.8.1-002", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/9", "version": "14.1.0-227", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/10", "version": "13.6.1-201", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/11", "version": "14.2.0-203", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/12", "version": "14.2.0-212", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/13", "version": "12.8.1-021", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/14", "version": "13.8.1-108", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/15", "version": "14.2.0-224", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/16", "version": "14.3.0-120", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/17", "version": "15.0.0-334", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/18", "version": "15.5.1-024", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/19", "version": "15.5.1-029", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/20", "version": "15.5.2-005", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/21", "version": "16.0.0-195", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/22", "version": "15.5.3-017", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/23", "version": "16.0.1-010", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/24", "version": "15.0.1-035", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/25", "version": "16.0.2-088", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "In December 2025, the Cisco Product Security Incident Response Team (PSIRT) became aware of potentially malicious activity that targets Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-20", "lang": "en", "description": "Improper Input Validation", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4", "label": "cisco-sa-sma-attack-N9bf4", "tags": [], "provider": "cisco", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Secure Email\",\"versions\":[{\"version\":\"14.0.0-698\",\"status\":\"affected\"},{\"version\":\"13.5.1-277\",\"status\":\"affected\"},{\"version\":\"13.0.0-392\",\"status\":\"affected\"},{\"version\":\"14.2.0-620\",\"status\":\"affected\"},{\"version\":\"13.0.5-007\",\"status\":\"affected\"},{\"version\":\"13.5.4-038\",\"status\":\"affected\"},{\"version\":\"14.2.1-020\",\"status\":\"affected\"},{\"version\":\"14.3.0-032\",\"status\":\"affected\"},{\"version\":\"15.0.0-104\",\"status\":\"affected\"},{\"version\":\"15.0.1-030\",\"status\":\"affected\"},{\"version\":\"15.5.0-048\",\"status\":\"affected\"},{\"version\":\"15.5.1-055\",\"status\":\"affected\"},{\"version\":\"15.5.2-018\",\"status\":\"affected\"},{\"version\":\"16.0.0-050\",\"status\":\"affected\"},{\"version\":\"15.0.3-002\",\"status\":\"affected\"},{\"version\":\"16.0.0-054\",\"status\":\"affected\"},{\"version\":\"15.5.3-022\",\"status\":\"affected\"},{\"version\":\"16.0.1-017\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Secure Email and Web Manager\",\"versions\":[{\"version\":\"13.6.2-023\",\"status\":\"affected\"},{\"version\":\"13.6.2-078\",\"status\":\"affected\"},{\"version\":\"13.0.0-249\",\"status\":\"affected\"},{\"version\":\"13.0.0-277\",\"status\":\"affected\"},{\"version\":\"13.8.1-052\",\"status\":\"affected\"},{\"version\":\"13.8.1-068\",\"status\":\"affected\"},{\"version\":\"13.8.1-074\",\"status\":\"affected\"},{\"version\":\"14.0.0-404\",\"status\":\"affected\"},{\"version\":\"12.8.1-002\",\"status\":\"affected\"},{\"version\":\"14.1.0-227\",\"status\":\"affected\"},{\"version\":\"13.6.1-201\",\"status\":\"affected\"},{\"version\":\"14.2.0-203\",\"status\":\"affected\"},{\"version\":\"14.2.0-212\",\"status\":\"affected\"},{\"version\":\"12.8.1-021\",\"status\":\"affected\"},{\"version\":\"13.8.1-108\",\"status\":\"affected\"},{\"version\":\"14.2.0-224\",\"status\":\"affected\"},{\"version\":\"14.3.0-120\",\"status\":\"affected\"},{\"version\":\"15.0.0-334\",\"status\":\"affected\"},{\"version\":\"15.5.1-024\",\"status\":\"affected\"},{\"version\":\"15.5.1-029\",\"status\":\"affected\"},{\"version\":\"15.5.2-005\",\"status\":\"affected\"},{\"version\":\"16.0.0-195\",\"status\":\"affected\"},{\"version\":\"15.5.3-017\",\"status\":\"affected\"},{\"version\":\"16.0.1-010\",\"status\":\"affected\"},{\"version\":\"15.0.1-035\",\"status\":\"affected\"},{\"version\":\"16.0.2-088\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.\r\n\r\nThis vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "In December 2025, the Cisco Product Security Incident Response Team (PSIRT) became aware of potentially malicious activity that targets Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Improper Input Validation\",\"type\":\"cwe\",\"cweId\":\"CWE-20\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-07T19:22:07.139Z", "fetchedAt": "2026-10-23T02:43:35.920Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-12-17T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Cisco Secure Email / Cisco Secure Email and Web Managerにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:23.535Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ce2e3f2f124c0a3ed4c0c0b64d0c9972131a7c0494247f68ba3476d72b2654b3", "sourceModifiedAt": "2026-10-07T19:22:07.139Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco Secure Email Gateway と Cisco Secure Email and Web Manager の Spam Quarantine 機能において、HTTP リクエストの検証が不十分なため、認証されていないリモート攻撃者が細工したリクエストを送るだけで、対象デバイス上で root 権限の任意コマンドを実行できる可能性があります。", "risk": "攻撃者が成功すると、対象デバイスの OS 上で root 権限で任意のコマンドが実行され、システム全体を支配される恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Cisco Secure Email の以下のバージョンが影響を受けます: 14.0.0-698、13.5.1-277、13.0.0-392、14.2.0-620、13.0.5-007、13.5.4-038、14.2.1-020、14.3.0-032、15.0.0-104、15.0.1-030、15.5.0-048、15.5.1-055、15.5.2-018、16.0.0-050、15.0.3-002、16.0.0-054、15.5.3-022、16.0.1-017。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Cisco Secure Email and Web Manager の以下のバージョンが影響を受けます: 13.6.2-023、13.6.2-078、13.0.0-249、13.0.0-277、13.8.1-052、13.8.1-068、13.8.1-074、14.0.0-404、12.8.1-002、14.1.0-227、13.6.1-201、14.2.0-203、14.2.0-212、12.8.1-021、13.8.1-108、14.2.0-224、14.3.0-120、15.0.0-334、15.5.1-024、15.5.1-029、15.5.2-005、16.0.0-195、15.5.3-017、16.0.1-010、15.0.1-035、16.0.2-088。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：Cisco / Cisco Secure Email。影響ありとして記載：14.0.0-698。影響ありとして記載：13.5.1-277。影響ありとして記載：13.0.0-392。影響ありとして記載：14.2.0-620。影響ありとして記載：13.0.5-007。影響ありとして記載：13.5.4-038。影響ありとして記載：14.2.1-020。影響ありとして記載：14.3.0-032。影響ありとして記載：15.0.0-104。影響ありとして記載：15.0.1-030。影響ありとして記載：15.5.0-048。影響ありとして記載：15.5.1-055。影響ありとして記載：15.5.2-018。影響ありとして記載：16.0.0-050。影響ありとして記載：15.0.3-002。影響ありとして記載：16.0.0-054。影響ありとして記載：15.5.3-022。影響ありとして記載：16.0.1-017。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Cisco / Cisco Secure Email and Web Manager。影響ありとして記載：13.6.2-023。影響ありとして記載：13.6.2-078。影響ありとして記載：13.0.0-249。影響ありとして記載：13.0.0-277。影響ありとして記載：13.8.1-052。影響ありとして記載：13.8.1-068。影響ありとして記載：13.8.1-074。影響ありとして記載：14.0.0-404。影響ありとして記載：12.8.1-002。影響ありとして記載：14.1.0-227。影響ありとして記載：13.6.1-201。影響ありとして記載：14.2.0-203。影響ありとして記載：14.2.0-212。影響ありとして記載：12.8.1-021。影響ありとして記載：13.8.1-108。影響ありとして記載：14.2.0-224。影響ありとして記載：14.3.0-120。影響ありとして記載：15.0.0-334。影響ありとして記載：15.5.1-024。影響ありとして記載：15.5.1-029。影響ありとして記載：15.5.2-005。影響ありとして記載：16.0.0-195。影響ありとして記載：15.5.3-017。影響ありとして記載：16.0.1-010。影響ありとして記載：15.0.1-035。影響ありとして記載：16.0.2-088。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-20393" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Cisco Secure Email / Cisco Secure Email and Web Manager」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-20393", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-20393", "https://nvd.nist.gov/vuln/detail/CVE-2025-20393" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-20393", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-20393", "https://nvd.nist.gov/vuln/detail/CVE-2025-20393" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-20393", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-20393", "https://nvd.nist.gov/vuln/detail/CVE-2025-20393" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-20393", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-20393", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20393", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.\r\n\r\nThis vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json", "sourceField": "/containers/cna/title", "excerpt": "Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Secure Email\",\"versions\":[{\"version\":\"14.0.0-698\",\"status\":\"affected\"},{\"version\":\"13.5.1-277\",\"status\":\"affected\"},{\"version\":\"13.0.0-392\",\"status\":\"affected\"},{\"version\":\"14.2.0-620\",\"status\":\"affected\"},{\"version\":\"13.0.5-007\",\"status\":\"affected\"},{\"version\":\"13.5.4-038\",\"status\":\"affected\"},{\"version\":\"14.2.1-020\",\"status\":\"affected\"},{\"version\":\"14.3.0-032\",\"status\":\"affected\"},{\"version\":\"15.0.0-104\",\"status\":\"affected\"},{\"version\":\"15.0.1-030\",\"status\":\"affected\"},{\"version\":\"15.5.0-048\",\"status\":\"affected\"},{\"version\":\"15.5.1-055\",\"status\":\"affected\"},{\"version\":\"15.5.2-018\",\"status\":\"affected\"},{\"version\":\"16.0.0-050\",\"status\":\"affected\"},{\"version\":\"15.0.3-002\",\"status\":\"affected\"},{\"version\":\"16.0.0-054\",\"status\":\"affected\"},{\"version\":\"15.5.3-022\",\"status\":\"affected\"},{\"version\":\"16.0.1-017\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20393.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Secure Email and Web Manager\",\"versions\":[{\"version\":\"13.6.2-023\",\"status\":\"affected\"},{\"version\":\"13.6.2-078\",\"status\":\"affected\"},{\"version\":\"13.0.0-249\",\"status\":\"affected\"},{\"version\":\"13.0.0-277\",\"status\":\"affected\"},{\"version\":\"13.8.1-052\",\"status\":\"affected\"},{\"version\":\"13.8.1-068\",\"status\":\"affected\"},{\"version\":\"13.8.1-074\",\"status\":\"affected\"},{\"version\":\"14.0.0-404\",\"status\":\"affected\"},{\"version\":\"12.8.1-002\",\"status\":\"affected\"},{\"version\":\"14.1.0-227\",\"status\":\"affected\"},{\"version\":\"13.6.1-201\",\"status\":\"affected\"},{\"version\":\"14.2.0-203\",\"status\":\"affected\"},{\"version\":\"14.2.0-212\",\"status\":\"affected\"},{\"version\":\"12.8.1-021\",\"status\":\"affected\"},{\"version\":\"13.8.1-108\",\"status\":\"affected\"},{\"version\":\"14.2.0-224\",\"status\":\"affected\"},{\"version\":\"14.3.0-120\",\"status\":\"affected\"},{\"version\":\"15.0.0-334\",\"status\":\"affected\"},{\"version\":\"15.5.1-024\",\"status\":\"affected\"},{\"version\":\"15.5.1-029\",\"status\":\"affected\"},{\"version\":\"15.5.2-005\",\"status\":\"affected\"},{\"version\":\"16.0.0-195\",\"status\":\"affected\"},{\"version\":\"15.5.3-017\",\"status\":\"affected\"},{\"version\":\"16.0.1-010\",\"status\":\"affected\"},{\"version\":\"15.0.1-035\",\"status\":\"affected\"},{\"version\":\"16.0.2-088\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-20393", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-20393\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-20393（Cisco Secure Email / Cisco Secure Email and Web Manager）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Cisco Secure Email の以下のバージョンが影響を受けます: 14.0.0-698、13.5.1-277、13.0.0-392、14.2.0-620、13.0.5-007、13.5.4-038、14.2.1-020、14.3.0-032、15.0.0-104、15.0.1-030、15.5.0-048、15.5.1-055、15.5.2-018、16.0.0-050、15.0.3-002、16.0.0-054、15.5.3-022、16.0.1-017。\n・Cisco Secure Email and Web Manager の以下のバージョンが影響を受けます: 13.6.2-023、13.6.2-078、13.0.0-249、13.0.0-277、13.8.1-052、13.8.1-068、13.8.1-074、14.0.0-404、12.8.1-002、14.1.0-227、13.6.1-201、14.2.0-203、14.2.0-212、12.8.1-021、13.8.1-108、14.2.0-224、14.3.0-120、15.0.0-334、15.5.1-024、15.5.1-029、15.5.2-005、16.0.0-195、15.5.3-017、16.0.1-010、15.0.1-035、16.0.2-088。\n・公式の対象表：Cisco / Cisco Secure Email。影響ありとして記載：14.0.0-698。影響ありとして記載：13.5.1-277。影響ありとして記載：13.0.0-392。影響ありとして記載：14.2.0-620。影響ありとして記載：13.0.5-007。影響ありとして記載：13.5.4-038。影響ありとして記載：14.2.1-020。影響ありとして記載：14.3.0-032。影響ありとして記載：15.0.0-104。影響ありとして記載：15.0.1-030。影響ありとして記載：15.5.0-048。影響ありとして記載：15.5.1-055。影響ありとして記載：15.5.2-018。影響ありとして記載：16.0.0-050。影響ありとして記載：15.0.3-002。影響ありとして記載：16.0.0-054。影響ありとして記載：15.5.3-022。影響ありとして記載：16.0.1-017。個別に記されていない版の影響は、原資料でも未確定です。\n・公式の対象表：Cisco / Cisco Secure Email and Web Manager。影響ありとして記載：13.6.2-023。影響ありとして記載：13.6.2-078。影響ありとして記載：13.0.0-249。影響ありとして記載：13.0.0-277。影響ありとして記載：13.8.1-052。影響ありとして記載：13.8.1-068。影響ありとして記載：13.8.1-074。影響ありとして記載：14.0.0-404。影響ありとして記載：12.8.1-002。影響ありとして記載：14.1.0-227。影響ありとして記載：13.6.1-201。影響ありとして記載：14.2.0-203。影響ありとして記載：14.2.0-212。影響ありとして記載：12.8.1-021。影響ありとして記載：13.8.1-108。影響ありとして記載：14.2.0-224。影響ありとして記載：14.3.0-120。影響ありとして記載：15.0.0-334。影響ありとして記載：15.5.1-024。影響ありとして記載：15.5.1-029。影響ありとして記載：15.5.2-005。影響ありとして記載：16.0.0-195。影響ありとして記載：15.5.3-017。影響ありとして記載：16.0.1-010。影響ありとして記載：15.0.1-035。影響ありとして記載：16.0.2-088。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-20393", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:23.535Z", "lastSuccess": "2026-10-23T03:25:23.535Z", "sourceCheckedAt": "2026-10-23T02:43:35.920Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-40602", "aliases": [], "title": "SMA1000：権限の奪取", "summary": "SonicWall SMA1000 アプライアンスの管理コンソール (AMC) において、権限チェックが不十分なため、ローカルで権限を昇格させる脆弱性が存在します。", "risk": "ローカルで権限が昇格されると、攻撃者が本来許可されていない操作を実行できる可能性があります。", "product": "SMA1000", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "sonicwall", "cvssVector": null, "affected": [ { "product": "SMA1000", "range": "12.4.3-03093 (platform-hotfix) and earlier versions（環境: Linux）" }, { "product": "SMA1000", "range": "12.5.0-02002 (platform-hotfix) and earlier versions（環境: Linux）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json", "label": "CVE：sonicwall" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40602", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-40602", "label": "CVE公式レコード" }, { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40602", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-12-18T10:58:41.668Z", "modifiedAt": "2025-12-18T11:32:37.662Z", "fetchedAt": "2026-10-23T02:43:38.246Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unknown", "platforms": [ "Linux" ], "product": "SMA1000", "vendor": "SonicWall", "versions": [ { "status": "affected", "version": "12.4.3-03093 (platform-hotfix) and earlier versions" }, { "status": "affected", "version": "12.5.0-02002 (platform-hotfix) and earlier versions" } ] } ], "configurationNotes": "対象環境・機能: Linux。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-40602", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json", "fetchedAt": "2026-10-23T02:43:38.246Z", "publishedAt": "2025-12-18T10:58:41.668Z", "modifiedAt": "2025-12-18T11:32:37.662Z", "state": "published", "provider": "sonicwall", "title": "", "descriptions": [ { "lang": "en", "value": "A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "SonicWall", "product": "SMA1000", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [ "Linux" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.4.3-03093 (platform-hotfix) and earlier versions", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "12.5.0-02002 (platform-hotfix) and earlier versions", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-862", "lang": "en", "description": "CWE-862 Missing Authorization", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-250", "lang": "en", "description": "CWE-250 Execution with Unnecessary Privileges", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.6, "baseSeverity": "MEDIUM", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019", "label": "sonicwall", "tags": [ "vendor-advisory" ], "provider": "sonicwall", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40602", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unknown\",\"platforms\":[\"Linux\"],\"product\":\"SMA1000\",\"vendor\":\"SonicWall\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.4.3-03093 (platform-hotfix) and earlier versions\"},{\"status\":\"affected\",\"version\":\"12.5.0-02002 (platform-hotfix) and earlier versions\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-862\",\"description\":\"CWE-862 Missing Authorization\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"cweId\":\"CWE-250\",\"description\":\"CWE-250 Execution with Unnecessary Privileges\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":6.6,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-12-18T11:32:37.662Z", "fetchedAt": "2026-10-23T02:43:38.246Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-12-17T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable", "sourceSummary": "SMA1000に権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:25:23.798Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "cfb28e1ad0a96be418cc0689462258860ff93956e62d84e69207db6fa78f2155", "sourceModifiedAt": "2025-12-18T11:32:37.662Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SonicWall SMA1000 アプライアンスの管理コンソール (AMC) において、権限チェックが不十分なため、ローカルで権限を昇格させる脆弱性が存在します。", "risk": "ローカルで権限が昇格されると、攻撃者が本来許可されていない操作を実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Linux 上の SMA1000 製品で、バージョン 12.4.3-03093 (platform-hotfix) 以前のバージョンは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json" ], "evidenceIds": [ "E2" ] }, { "text": "Linux 上の SMA1000 製品で、バージョン 12.5.0-02002 (platform-hotfix) 以前のバージョンは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：SonicWall / SMA1000。影響ありとして記載：12.4.3-03093 (platform-hotfix) and earlier versions。影響ありとして記載：12.5.0-02002 (platform-hotfix) and earlier versions。対象の環境：Linux。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40602" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json" ], "evidenceIds": [ "E2" ] }, { "text": "「SMA1000」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-40602", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40602", "https://nvd.nist.gov/vuln/detail/CVE-2025-40602" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-40602", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40602", "https://nvd.nist.gov/vuln/detail/CVE-2025-40602" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-40602", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40602", "https://nvd.nist.gov/vuln/detail/CVE-2025-40602" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json", "label": "CVE：sonicwall" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40602", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-40602", "label": "CVE公式レコード" }, { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40602", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40602.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unknown\",\"platforms\":[\"Linux\"],\"product\":\"SMA1000\",\"vendor\":\"SonicWall\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.4.3-03093 (platform-hotfix) and earlier versions\"},{\"status\":\"affected\",\"version\":\"12.5.0-02002 (platform-hotfix) and earlier versions\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40602", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-40602\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-40602（SMA1000）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Linux 上の SMA1000 製品で、バージョン 12.4.3-03093 (platform-hotfix) 以前のバージョンは影響を受けます。\n・Linux 上の SMA1000 製品で、バージョン 12.5.0-02002 (platform-hotfix) 以前のバージョンは影響を受けます。\n・公式の対象表：SonicWall / SMA1000。影響ありとして記載：12.4.3-03093 (platform-hotfix) and earlier versions。影響ありとして記載：12.5.0-02002 (platform-hotfix) and earlier versions。対象の環境：Linux。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-40602", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:25:23.798Z", "lastSuccess": "2026-10-23T03:25:23.798Z", "sourceCheckedAt": "2026-10-23T02:43:38.246Z", "errorCode": null }, "glossary": [] } } ], "total": 2216, "limit": 20, "offset": 680, "filters": { "product": "all", "type": "all", "q": "", "page": 35 }, "pagination": { "page": 35, "pageSize": 20, "totalPages": 111 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-24T03:17:49.216Z", "lastAttempt": "2026-10-24T03:17:49.216Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-24T03:17:49.216Z", "lastAttempt": "2026-10-24T03:17:49.216Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-24T03:17:49.216Z", "lastAttempt": "2026-10-24T03:17:49.216Z", "error": null, "recordCount": 1756, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "partial", "lastSuccess": "2026-10-23T21:17:50.096Z", "lastAttempt": "2026-10-24T03:17:49.216Z", "error": "未確認のページ・期間は次回の定期取得で続きから反映します。", "recordCount": 3, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T21:02:50.096Z 〜 2026-10-24T02:17:49.350Z、全製品の変更 1000/2399件まで確認、対象3件反映。", "cursor": { "start": "2026-10-23T21:02:50.096Z", "end": "2026-10-24T02:17:49.350Z", "kind": "modified", "index": 1000 }, "freshness": "stale", "stale": true }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-24T03:17:49.216Z", "lastAttempt": "2026-10-24T03:17:49.216Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }