{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2025-31200", "aliases": [], "title": "iOS and iPadOS / macOS / tvOS / visionOS / watchOS：脆弱性情報", "summary": "メモリ破損の問題は、境界チェックの改善により対処されました。この問題は iOS 18.4.1、iPadOS 18.4.1、macOS Sequoia 15.4.1、tvOS 18.4.1、visionOS 2.4.1、watchOS 11.5 で修正されています。悪意のあるメディアファイルのオーディオストリームを処理するとコードが実行される可能性があり、Apple は iOS 18.4.1 以前のバージョンで特定の標的に対する極めて高度な攻撃でこの問題が悪用されたとの報告を認識しています。", "risk": "悪意のあるメディアファイルを再生させられると、攻撃者がコードを実行できる可能性があります。", "product": "iOS and iPadOS / macOS / tvOS / visionOS / watchOS", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apple", "cvssVector": null, "affected": [ { "product": "iOS and iPadOS", "range": "< 18.4.1" }, { "product": "macOS", "range": "< 15.4.1" }, { "product": "tvOS", "range": "< 18.4.1" }, { "product": "visionOS", "range": "< 2.4.1" }, { "product": "watchOS", "range": "< 11.5" } ], "fixed": [], "steps": [ "この問題は iOS 18.4.1、iPadOS 18.4.1、macOS Sequoia 15.4.1、tvOS 18.4.1、visionOS 2.4.1、watchOS 11.5 で修正されています。", "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31200", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-31200", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/122282", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122400", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122401", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122402", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122722", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31200", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-04-16T18:24:31.578Z", "modifiedAt": "2026-04-02T18:25:21.000Z", "fetchedAt": "2026-10-24T04:52:30.832Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "18.4.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "macOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "15.4.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "tvOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "18.4.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "visionOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "2.4.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "watchOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "11.5", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-31200", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "fetchedAt": "2026-10-24T04:52:30.832Z", "publishedAt": "2025-04-16T18:24:31.578Z", "modifiedAt": "2026-04-02T18:25:21.000Z", "state": "published", "provider": "apple", "title": "", "descriptions": [ { "lang": "en", "value": "A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31200", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "18.4.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThan": "15.4.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "tvOS", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "0", "lessThan": "18.4.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "visionOS", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "0", "lessThan": "2.4.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "watchOS", "sourcePath": "/containers/cna/affected/4", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "0", "lessThan": "11.5", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.apple.com/en-us/122282", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/0" }, { "url": "https://support.apple.com/en-us/122400", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/1" }, { "url": "https://support.apple.com/en-us/122401", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/2" }, { "url": "https://support.apple.com/en-us/122402", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/3" }, { "url": "https://support.apple.com/en-us/122722", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/4" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31200", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.md", "label": "CISA-ADP", "tags": [ "technical-description" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://github.com/cisagov/vulnrichment/issues/200", "label": "CISA-ADP", "tags": [ "issue-tracking" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://blog.noahhw.dev/posts/cve-2025-31200/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://news.ycombinator.com/item?id=44161894", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "http://seclists.org/fulldisclosure/2025/Oct/4", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" }, { "url": "http://seclists.org/fulldisclosure/2025/Oct/0", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/3" }, { "url": "http://seclists.org/fulldisclosure/2025/Jun/14", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/4" }, { "url": "http://seclists.org/fulldisclosure/2025/May/10", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/5" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/26", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.4.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"15.4.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.4.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"2.4.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"11.5\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-31200:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31200", "sourcePath": "retained:/originalText", "text": "Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-31200:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31200", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31200", "modifiedAt": "2025-04-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-04-02T18:25:21.000Z", "fetchedAt": "2026-10-24T04:52:30.832Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-04-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "iOS and iPadOS / macOS / tvOS / visionOS / watchOSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:52:30.832Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8ab0ab773d2506af63169cac78b6f31c504bb03728bf81553bc8ccbf05f7d1c8", "sourceModifiedAt": "2026-04-02T18:25:21.000Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "メモリ破損の問題は、境界チェックの改善により対処されました。この問題は iOS 18.4.1、iPadOS 18.4.1、macOS Sequoia 15.4.1、tvOS 18.4.1、visionOS 2.4.1、watchOS 11.5 で修正されています。悪意のあるメディアファイルのオーディオストリームを処理するとコードが実行される可能性があり、Apple は iOS 18.4.1 以前のバージョンで特定の標的に対する極めて高度な攻撃でこの問題が悪用されたとの報告を認識しています。", "risk": "悪意のあるメディアファイルを再生させられると、攻撃者がコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "攻撃者が悪意のあるメディアファイルを作成し、被害者がそのファイルのオーディオストリームを処理（例：再生）することが必要です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：18.4.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Apple / macOS。影響ありとして記載：15.4.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apple / tvOS。影響ありとして記載：18.4.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Apple / visionOS。影響ありとして記載：2.4.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Apple / watchOS。影響ありとして記載：11.5未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json" ], "evidenceIds": [ "E7" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31200" ], "evidenceIds": [ "E8" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json" ], "evidenceIds": [ "E3" ] }, { "text": "「iOS and iPadOS / macOS / tvOS / visionOS / watchOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-31200", "https://support.apple.com/en-us/122282", "https://support.apple.com/en-us/122400", "https://support.apple.com/en-us/122401", "https://support.apple.com/en-us/122402", "https://support.apple.com/en-us/122722", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31200", "https://nvd.nist.gov/vuln/detail/CVE-2025-31200" ] } ], "actions": [ { "text": "この問題は iOS 18.4.1、iPadOS 18.4.1、macOS Sequoia 15.4.1、tvOS 18.4.1、visionOS 2.4.1、watchOS 11.5 で修正されています。", "kind": "fix", "evidenceIds": [ "E1" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json" ] }, { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-31200", "https://support.apple.com/en-us/122282", "https://support.apple.com/en-us/122400", "https://support.apple.com/en-us/122401", "https://support.apple.com/en-us/122402", "https://support.apple.com/en-us/122722", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31200", "https://nvd.nist.gov/vuln/detail/CVE-2025-31200" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-31200", "https://support.apple.com/en-us/122282", "https://support.apple.com/en-us/122400", "https://support.apple.com/en-us/122401", "https://support.apple.com/en-us/122402", "https://support.apple.com/en-us/122722", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31200", "https://nvd.nist.gov/vuln/detail/CVE-2025-31200" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31200", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-31200", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/122282", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122400", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122401", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122402", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122722", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31200", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31200", "sourceField": "retained:/originalText", "excerpt": "Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.4.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"15.4.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.4.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"2.4.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31200.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"11.5\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31200", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-31200\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-31200（iOS and iPadOS / macOS / tvOS / visionOS / watchOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者が悪意のあるメディアファイルを作成し、被害者がそのファイルのオーディオストリームを処理（例：再生）することが必要です。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：18.4.1未満の版。\n・公式の対象表：Apple / macOS。影響ありとして記載：15.4.1未満の版。\n・公式の対象表：Apple / tvOS。影響ありとして記載：18.4.1未満の版。\n・公式の対象表：Apple / visionOS。影響ありとして記載：2.4.1未満の版。\n・公式の対象表：Apple / watchOS。影響ありとして記載：11.5未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-31200", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:52:30.832Z", "lastSuccess": "2026-10-24T04:52:30.832Z", "sourceCheckedAt": "2026-10-24T04:52:30.832Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-31201", "aliases": [], "title": "iOS and iPadOS / macOS / tvOS / visionOS：脆弱性情報", "summary": "この問題は脆弱なコードを削除することで対処されました。iOS 18.4.1、iPadOS 18.4.1、macOS Sequoia 15.4.1、tvOS 18.4.1、visionOS 2.4.1で修正されています。任意の読み取りおよび書き込み権限を持つ攻撃者は、ポインタ認証を回避できる可能性があります。Apple は、この問題が iOS 上で特定の標的個人に対して極めて高度な攻撃に利用されたとの報告を認識しています。", "risk": "攻撃者がポインタ認証を回避できる可能性があります。", "product": "iOS and iPadOS / macOS / tvOS / visionOS", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apple", "cvssVector": null, "affected": [ { "product": "iOS and iPadOS", "range": "< 18.4.1" }, { "product": "macOS", "range": "< 15.4.1" }, { "product": "tvOS", "range": "< 18.4.1" }, { "product": "visionOS", "range": "< 2.4.1" } ], "fixed": [], "steps": [ "iOS 18.4.1、iPadOS 18.4.1、macOS Sequoia 15.4.1、tvOS 18.4.1、visionOS 2.4.1で修正されています。", "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31201", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-31201", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/122282", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122400", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122401", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122402", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31201", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-04-16T18:24:31.230Z", "modifiedAt": "2026-04-02T18:24:41.543Z", "fetchedAt": "2026-10-24T04:52:34.744Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "18.4.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "macOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "15.4.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "tvOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "18.4.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "visionOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "2.4.1", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-31201", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "fetchedAt": "2026-10-24T04:52:34.744Z", "publishedAt": "2025-04-16T18:24:31.230Z", "modifiedAt": "2026-04-02T18:24:41.543Z", "state": "published", "provider": "apple", "title": "", "descriptions": [ { "lang": "en", "value": "This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31201", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "18.4.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThan": "15.4.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "tvOS", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "0", "lessThan": "18.4.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "visionOS", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "0", "lessThan": "2.4.1", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.apple.com/en-us/122282", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/0" }, { "url": "https://support.apple.com/en-us/122400", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/1" }, { "url": "https://support.apple.com/en-us/122401", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/2" }, { "url": "https://support.apple.com/en-us/122402", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/3" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31201", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.md", "label": "CISA-ADP", "tags": [ "technical-description" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://github.com/cisagov/vulnrichment/issues/200", "label": "CISA-ADP", "tags": [ "issue-tracking" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://seclists.org/fulldisclosure/2025/Oct/4", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "http://seclists.org/fulldisclosure/2025/Oct/3", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "http://seclists.org/fulldisclosure/2025/Oct/0", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" }, { "url": "http://seclists.org/fulldisclosure/2025/Jun/14", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/3" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/26", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/4" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.4.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"15.4.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.4.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"2.4.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-31201:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31201", "sourcePath": "retained:/originalText", "text": "Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-31201:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31201", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31201", "modifiedAt": "2025-04-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-04-02T18:24:41.543Z", "fetchedAt": "2026-10-24T04:52:34.744Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-04-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "iOS and iPadOS / macOS / tvOS / visionOSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:52:34.744Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "aadeb5551785a75ec1039b9510127023cbcd3268167f1df42d063b3f30efb18c", "sourceModifiedAt": "2026-04-02T18:24:41.543Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "この問題は脆弱なコードを削除することで対処されました。iOS 18.4.1、iPadOS 18.4.1、macOS Sequoia 15.4.1、tvOS 18.4.1、visionOS 2.4.1で修正されています。任意の読み取りおよび書き込み権限を持つ攻撃者は、ポインタ認証を回避できる可能性があります。Apple は、この問題が iOS 上で特定の標的個人に対して極めて高度な攻撃に利用されたとの報告を認識しています。", "risk": "攻撃者がポインタ認証を回避できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者が任意の読み取りおよび書き込み権限を持っている場合に、この脆弱性が悪用可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：18.4.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Apple / macOS。影響ありとして記載：15.4.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Apple / tvOS。影響ありとして記載：18.4.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apple / visionOS。影響ありとして記載：2.4.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31201" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json" ], "evidenceIds": [ "E2" ] }, { "text": "「iOS and iPadOS / macOS / tvOS / visionOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-31201", "https://support.apple.com/en-us/122282", "https://support.apple.com/en-us/122400", "https://support.apple.com/en-us/122401", "https://support.apple.com/en-us/122402", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31201", "https://nvd.nist.gov/vuln/detail/CVE-2025-31201" ] } ], "actions": [ { "text": "iOS 18.4.1、iPadOS 18.4.1、macOS Sequoia 15.4.1、tvOS 18.4.1、visionOS 2.4.1で修正されています。", "kind": "fix", "evidenceIds": [ "E1" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json" ] }, { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-31201", "https://support.apple.com/en-us/122282", "https://support.apple.com/en-us/122400", "https://support.apple.com/en-us/122401", "https://support.apple.com/en-us/122402", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31201", "https://nvd.nist.gov/vuln/detail/CVE-2025-31201" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-31201", "https://support.apple.com/en-us/122282", "https://support.apple.com/en-us/122400", "https://support.apple.com/en-us/122401", "https://support.apple.com/en-us/122402", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31201", "https://nvd.nist.gov/vuln/detail/CVE-2025-31201" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31201", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-31201", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/122282", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122400", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122401", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122402", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31201", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.4.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"15.4.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.4.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31201.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"2.4.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31201", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-31201\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-31201（iOS and iPadOS / macOS / tvOS / visionOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者が任意の読み取りおよび書き込み権限を持っている場合に、この脆弱性が悪用可能です。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：18.4.1未満の版。\n・公式の対象表：Apple / macOS。影響ありとして記載：15.4.1未満の版。\n・公式の対象表：Apple / tvOS。影響ありとして記載：18.4.1未満の版。\n・公式の対象表：Apple / visionOS。影響ありとして記載：2.4.1未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-31201", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:52:34.744Z", "lastSuccess": "2026-10-24T04:52:34.744Z", "sourceCheckedAt": "2026-10-24T04:52:34.744Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2021-20035", "aliases": [], "title": "SMA100：コード実行", "summary": "SMA100 の管理インターフェイスで特殊文字が適切に無効化されていないため、リモートで認証された攻撃者が「nobody」ユーザーとして任意のコマンドを注入できる。", "risk": "このコマンド注入により、サービスが停止（DoS）したり、コードが実行されたりする可能性がある。", "product": "SMA100", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "sonicwall", "cvssVector": null, "affected": [ { "product": "SMA100", "range": "9.0.0.10-28sv and earlier" }, { "product": "SMA100", "range": "10.2.0.7-34sv and earlier" }, { "product": "SMA100", "range": "10.2.1.0-17sv and earlier" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json", "label": "CVE：sonicwall" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20035", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-20035", "label": "CVE公式レコード" }, { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20035", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2021-09-27T17:20:12.000Z", "modifiedAt": "2025-10-21T23:25:31.035Z", "fetchedAt": "2026-10-24T04:52:37.556Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "SMA100", "vendor": "SonicWall", "versions": [ { "status": "affected", "version": "9.0.0.10-28sv and earlier" }, { "status": "affected", "version": "10.2.0.7-34sv and earlier" }, { "status": "affected", "version": "10.2.1.0-17sv and earlier" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2021-20035", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json", "fetchedAt": "2026-10-24T04:52:37.556Z", "publishedAt": "2021-09-27T17:20:12.000Z", "modifiedAt": "2025-10-21T23:25:31.035Z", "state": "published", "provider": "sonicwall", "title": "", "descriptions": [ { "lang": "en", "value": "Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20035", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "SonicWall", "product": "SMA100", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "9.0.0.10-28sv and earlier", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "10.2.0.7-34sv and earlier", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "10.2.1.0-17sv and earlier", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20035", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"SMA100\",\"vendor\":\"SonicWall\",\"versions\":[{\"status\":\"affected\",\"version\":\"9.0.0.10-28sv and earlier\"},{\"status\":\"affected\",\"version\":\"10.2.0.7-34sv and earlier\"},{\"status\":\"affected\",\"version\":\"10.2.1.0-17sv and earlier\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-78\",\"description\":\"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":6.5,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"NONE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2021-20035:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20035", "sourcePath": "retained:/originalText", "text": "SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2021-20035:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20035", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20035", "modifiedAt": "2025-04-16T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:25:31.035Z", "fetchedAt": "2026-10-24T04:52:37.556Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-04-16T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "SMA100にコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:52:37.556Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "e3bf2adbdb3e2f95bc0a5f1ba99008f52ae089cb04fd5440596647534b4154f1", "sourceModifiedAt": "2025-10-21T23:25:31.035Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SMA100 の管理インターフェイスで特殊文字が適切に無効化されていないため、リモートで認証された攻撃者が「nobody」ユーザーとして任意のコマンドを注入できる。", "risk": "このコマンド注入により、サービスが停止（DoS）したり、コードが実行されたりする可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "リモートで認証された攻撃者が、SMA100 の管理インターフェイスにアクセスし、\"nobody\" ユーザーとしてコマンドを注入できることが前提条件となる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：SonicWall / SMA100。影響ありとして記載：9.0.0.10-28sv and earlier。影響ありとして記載：10.2.0.7-34sv and earlier。影響ありとして記載：10.2.1.0-17sv and earlier。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20035" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json" ], "evidenceIds": [ "E3" ] }, { "text": "「SMA100」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-20035", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20035", "https://nvd.nist.gov/vuln/detail/CVE-2021-20035" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2021-20035", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20035", "https://nvd.nist.gov/vuln/detail/CVE-2021-20035" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-20035", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20035", "https://nvd.nist.gov/vuln/detail/CVE-2021-20035" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json", "label": "CVE：sonicwall" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20035", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-20035", "label": "CVE公式レコード" }, { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20035", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20035", "sourceField": "retained:/originalText", "excerpt": "SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/20xxx/CVE-2021-20035.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"SMA100\",\"vendor\":\"SonicWall\",\"versions\":[{\"status\":\"affected\",\"version\":\"9.0.0.10-28sv and earlier\"},{\"status\":\"affected\",\"version\":\"10.2.0.7-34sv and earlier\"},{\"status\":\"affected\",\"version\":\"10.2.1.0-17sv and earlier\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20035", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2021-20035\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2021-20035（SMA100）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートで認証された攻撃者が、SMA100 の管理インターフェイスにアクセスし、\"nobody\" ユーザーとしてコマンドを注入できることが前提条件となる。\n・公式の対象表：SonicWall / SMA100。影響ありとして記載：9.0.0.10-28sv and earlier。影響ありとして記載：10.2.0.7-34sv and earlier。影響ありとして記載：10.2.1.0-17sv and earlier。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2021-20035", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:52:37.556Z", "lastSuccess": "2026-10-24T04:52:37.556Z", "sourceCheckedAt": "2026-10-24T04:52:37.556Z", "errorCode": null }, "glossary": [ { "term": "サービス拒否（DoS）", "meaning": "サービスや機能が停止したり、処理が遅くなったりして、通常どおり利用できなくなることです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/400.html", "kind": "general_definition" } ] } }, { "id": "CVE-2024-53150", "aliases": [], "title": "Linux：脆弱性情報", "summary": "Linux カーネルの USB‑audio ドライバは、クロック記述子を走査する際に各記述子の bLength を確認せず、長さが不足した偽装記述子が提供されると範囲外読み取りが発生する可能性があります。この問題に対処するため、パッチはクロック記述子走査用のバリデータ関数に妥当性チェックを追加し、期待より短い長さの記述子はループ内でスキップされます。クロックソースおよびクロックマルチプライヤ記述子については、各記述子型の sizeof() と bLength を比較してチェックし、UAC2・UAC3 のクロックセレクタ記述子は配列要素数 bNrInPins と末尾の 2 フィールドを追加で確認します。", "risk": "この範囲外読み取りにより、ローカルの特権ユーザーが潜在的に機密情報を取得できる可能性があります。", "product": "Linux", "category": "linux", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "Linux", "cvssVector": null, "affected": [ { "product": "Linux", "range": ">= b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a / < a632bdcb359fd8145e86486ff8612da98e239acd" }, { "product": "Linux", "range": ">= b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a / < 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b" }, { "product": "Linux", "range": ">= b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a / < ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9" }, { "product": "Linux", "range": ">= b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a / < da13ade87a12dd58829278bc816a61bea06a56a9" }, { "product": "Linux", "range": ">= b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a / < 74cb86e1006c5437b1d90084d22018da30fddc77" }, { "product": "Linux", "range": ">= b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a / < ea0fa76f61cf8e932d1d26e6193513230816e11d" }, { "product": "Linux", "range": ">= b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a / < 096bb5b43edf755bc4477e64004fa3a20539ec2f" }, { "product": "Linux", "range": ">= b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a / < a3dd4d63eeb452cfb064a13862fb376ab108f6a6" }, { "product": "Linux", "range": "9feeaa50e5b4b0b71259d918a36ecf9059e60796" }, { "product": "Linux", "range": "3b17a13b687ae99939dc94a4ae01fbc34f68decc" }, { "product": "Linux", "range": ">= 4.19.84 / < 4.20" }, { "product": "Linux", "range": ">= 5.3.11 / < 5.4" }, { "product": "Linux", "range": "5.4" }, { "product": "Linux", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53150", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-53150", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/a632bdcb359fd8145e86486ff8612da98e239acd", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/da13ade87a12dd58829278bc816a61bea06a56a9", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/ea0fa76f61cf8e932d1d26e6193513230816e11d", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/096bb5b43edf755bc4477e64004fa3a20539ec2f", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/a3dd4d63eeb452cfb064a13862fb376ab108f6a6", "label": "CVE掲載の参考情報" }, { "url": "https://lore.kernel.org/linux-cve-announce/2024122427-CVE-2024-53150-3a7d@gregkh/", "label": "CISAが示す関連情報" }, { "url": "https://source.android.com/docs/security/bulletin/2025-04-01", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53150", "label": "CISAが示す関連情報" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2024-12-24T11:28:50.175Z", "modifiedAt": "2026-05-23T15:55:17.404Z", "fetchedAt": "2026-10-24T06:04:19.685Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix out of bounds reads when finding clock sources\n\nThe current USB-audio driver code doesn't check bLength of each\ndescriptor at traversing for clock descriptors. That is, when a\ndevice provides a bogus descriptor with a shorter bLength, the driver\nmight hit out-of-bounds reads.\n\nFor addressing it, this patch adds sanity checks to the validator\nfunctions for the clock descriptor traversal. When the descriptor\nlength is shorter than expected, it's skipped in the loop.\n\nFor the clock source and clock multiplier descriptors, we can just\ncheck bLength against the sizeof() of each descriptor type.\nOTOH, the clock selector descriptor of UAC2 and UAC3 has an array\nof bNrInPins elements and two more fields at its tail, hence those\nhave to be checked in addition to the sizeof() check.", "sourceTitle": "ALSA: usb-audio: Fix out of bounds reads when finding clock sources", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/usb/clock.c" ], "versions": [ { "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "a632bdcb359fd8145e86486ff8612da98e239acd", "status": "affected", "versionType": "git" }, { "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "45a92cbc88e4013bfed7fd2ccab3ade45f8e896b", "status": "affected", "versionType": "git" }, { "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9", "status": "affected", "versionType": "git" }, { "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "da13ade87a12dd58829278bc816a61bea06a56a9", "status": "affected", "versionType": "git" }, { "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "74cb86e1006c5437b1d90084d22018da30fddc77", "status": "affected", "versionType": "git" }, { "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "ea0fa76f61cf8e932d1d26e6193513230816e11d", "status": "affected", "versionType": "git" }, { "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "096bb5b43edf755bc4477e64004fa3a20539ec2f", "status": "affected", "versionType": "git" }, { "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "a3dd4d63eeb452cfb064a13862fb376ab108f6a6", "status": "affected", "versionType": "git" }, { "version": "9feeaa50e5b4b0b71259d918a36ecf9059e60796", "status": "affected", "versionType": "git" }, { "version": "3b17a13b687ae99939dc94a4ae01fbc34f68decc", "status": "affected", "versionType": "git" }, { "version": "4.19.84", "lessThan": "4.20", "status": "affected", "versionType": "semver" }, { "version": "5.3.11", "lessThan": "5.4", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/usb/clock.c" ], "versions": [ { "version": "5.4", "status": "affected" }, { "version": "0", "lessThan": "5.4", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.287", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.231", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-53150", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json", "fetchedAt": "2026-10-24T06:04:19.685Z", "publishedAt": "2024-12-24T11:28:50.175Z", "modifiedAt": "2026-05-23T15:55:17.404Z", "state": "published", "provider": "Linux", "title": "ALSA: usb-audio: Fix out of bounds reads when finding clock sources", "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix out of bounds reads when finding clock sources\n\nThe current USB-audio driver code doesn't check bLength of each\ndescriptor at traversing for clock descriptors. That is, when a\ndevice provides a bogus descriptor with a shorter bLength, the driver\nmight hit out-of-bounds reads.\n\nFor addressing it, this patch adds sanity checks to the validator\nfunctions for the clock descriptor traversal. When the descriptor\nlength is shorter than expected, it's skipped in the loop.\n\nFor the clock source and clock multiplier descriptors, we can just\ncheck bLength against the sizeof() of each descriptor type.\nOTOH, the clock selector descriptor of UAC2 and UAC3 has an array\nof bNrInPins elements and two more fields at its tail, hence those\nhave to be checked in addition to the sizeof() check.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53150", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/0", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [ "sound/usb/clock.c" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "a632bdcb359fd8145e86486ff8612da98e239acd", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "45a92cbc88e4013bfed7fd2ccab3ade45f8e896b", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "da13ade87a12dd58829278bc816a61bea06a56a9", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "74cb86e1006c5437b1d90084d22018da30fddc77", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "ea0fa76f61cf8e932d1d26e6193513230816e11d", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "096bb5b43edf755bc4477e64004fa3a20539ec2f", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a", "lessThan": "a3dd4d63eeb452cfb064a13862fb376ab108f6a6", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "9feeaa50e5b4b0b71259d918a36ecf9059e60796", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "3b17a13b687ae99939dc94a4ae01fbc34f68decc", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "4.19.84", "lessThan": "4.20", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "5.3.11", "lessThan": "5.4", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/1", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [ "sound/usb/clock.c" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "5.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "0", "lessThan": "5.4", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "5.4.287", "lessThanOrEqual": "5.4.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "5.10.231", "lessThanOrEqual": "5.10.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "5.15.174", "lessThanOrEqual": "5.15.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": "6.1.120", "lessThanOrEqual": "6.1.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": "6.6.64", "lessThanOrEqual": "6.6.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/7", "version": "6.11.11", "lessThanOrEqual": "6.11.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/8", "version": "6.12.2", "lessThanOrEqual": "6.12.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/9", "version": "6.13", "lessThanOrEqual": "*", "versionType": "original_commit_for_fix", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://git.kernel.org/stable/c/a632bdcb359fd8145e86486ff8612da98e239acd", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/0" }, { "url": "https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/1" }, { "url": "https://git.kernel.org/stable/c/ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/2" }, { "url": "https://git.kernel.org/stable/c/da13ade87a12dd58829278bc816a61bea06a56a9", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/3" }, { "url": "https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/4" }, { "url": "https://git.kernel.org/stable/c/ea0fa76f61cf8e932d1d26e6193513230816e11d", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/5" }, { "url": "https://git.kernel.org/stable/c/096bb5b43edf755bc4477e64004fa3a20539ec2f", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/6" }, { "url": "https://git.kernel.org/stable/c/a3dd4d63eeb452cfb064a13862fb376ab108f6a6", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/7" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53150", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"sound/usb/clock.c\"],\"versions\":[{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"a632bdcb359fd8145e86486ff8612da98e239acd\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"45a92cbc88e4013bfed7fd2ccab3ade45f8e896b\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"da13ade87a12dd58829278bc816a61bea06a56a9\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"74cb86e1006c5437b1d90084d22018da30fddc77\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"ea0fa76f61cf8e932d1d26e6193513230816e11d\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"096bb5b43edf755bc4477e64004fa3a20539ec2f\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"a3dd4d63eeb452cfb064a13862fb376ab108f6a6\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"9feeaa50e5b4b0b71259d918a36ecf9059e60796\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"3b17a13b687ae99939dc94a4ae01fbc34f68decc\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"4.19.84\",\"lessThan\":\"4.20\",\"status\":\"affected\",\"versionType\":\"semver\"},{\"version\":\"5.3.11\",\"lessThan\":\"5.4\",\"status\":\"affected\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"sound/usb/clock.c\"],\"versions\":[{\"version\":\"5.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.4\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.4.287\",\"lessThanOrEqual\":\"5.4.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.10.231\",\"lessThanOrEqual\":\"5.10.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.15.174\",\"lessThanOrEqual\":\"5.15.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.64\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.11.11\",\"lessThanOrEqual\":\"6.11.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.2\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix out of bounds reads when finding clock sources\n\nThe current USB-audio driver code doesn't check bLength of each\ndescriptor at traversing for clock descriptors. That is, when a\ndevice provides a bogus descriptor with a shorter bLength, the driver\nmight hit out-of-bounds reads.\n\nFor addressing it, this patch adds sanity checks to the validator\nfunctions for the clock descriptor traversal. When the descriptor\nlength is shorter than expected, it's skipped in the loop.\n\nFor the clock source and clock multiplier descriptors, we can just\ncheck bLength against the sizeof() of each descriptor type.\nOTOH, the clock selector descriptor of UAC2 and UAC3 has an array\nof bNrInPins elements and two more fields at its tail, hence those\nhave to be checked in addition to the sizeof() check.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.1,\"attackVector\":\"LOCAL\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-53150:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53150", "sourcePath": "retained:/originalText", "text": "Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-53150:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53150", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53150", "modifiedAt": "2025-04-09T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-05-23T15:55:17.404Z", "fetchedAt": "2026-10-24T06:04:19.685Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-04-09T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Linuxに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T06:04:19.685Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "0ab74dad90fc217a496aeef1eebf6c939e13c4d71b1f496a5f442876ff55b996", "sourceModifiedAt": "2026-05-23T15:55:17.404Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Linux カーネルの USB‑audio ドライバは、クロック記述子を走査する際に各記述子の bLength を確認せず、長さが不足した偽装記述子が提供されると範囲外読み取りが発生する可能性があります。この問題に対処するため、パッチはクロック記述子走査用のバリデータ関数に妥当性チェックを追加し、期待より短い長さの記述子はループ内でスキップされます。クロックソースおよびクロックマルチプライヤ記述子については、各記述子型の sizeof() と bLength を比較してチェックし、UAC2・UAC3 のクロックセレクタ記述子は配列要素数 bNrInPins と末尾の 2 フィールドを追加で確認します。", "risk": "この範囲外読み取りにより、ローカルの特権ユーザーが潜在的に機密情報を取得できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "公式の対象表：Linux / Linux。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、a632bdcb359fd8145e86486ff8612da98e239acd未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、45a92cbc88e4013bfed7fd2ccab3ade45f8e896b未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、da13ade87a12dd58829278bc816a61bea06a56a9未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、74cb86e1006c5437b1d90084d22018da30fddc77未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、ea0fa76f61cf8e932d1d26e6193513230816e11d未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、096bb5b43edf755bc4477e64004fa3a20539ec2f未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、a3dd4d63eeb452cfb064a13862fb376ab108f6a6未満。影響ありとして記載：9feeaa50e5b4b0b71259d918a36ecf9059e60796。影響ありとして記載：3b17a13b687ae99939dc94a4ae01fbc34f68decc。影響ありとして記載：4.19.84以上、4.20未満。影響ありとして記載：5.3.11以上、5.4未満。対象のファイル：sound/usb/clock.c", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Linux / Linux。影響ありとして記載：5.4。影響なしとして記載：5.4未満の版。影響なしとして記載：5.4.287以上、5.4.*以下。影響なしとして記載：5.10.231以上、5.10.*以下。影響なしとして記載：5.15.174以上、5.15.*以下。影響なしとして記載：6.1.120以上、6.1.*以下。影響なしとして記載：6.6.64以上、6.6.*以下。影響なしとして記載：6.11.11以上、6.11.*以下。影響なしとして記載：6.12.2以上、6.12.*以下。影響なしとして記載：6.13以上（原資料の上限表記は「*」）。対象のファイル：sound/usb/clock.c。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53150" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json" ], "evidenceIds": [ "E4" ] }, { "text": "管理担当者に、Linuxの種類（Ubuntu、Red Hatなど）と版、対象パッケージ名、配布元を含む完全なパッケージ番号を確認してもらいます。OSの種類や製品の上流の番号だけで、影響の有無を決めないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "更新が用意されていない場合は、配布元や保守会社へCVE番号とパッケージ番号を送り、影響の有無・回避策・提供予定を確認します。他のLinux向けの修正をそのまま入れないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json" ], "evidenceIds": [ "E4" ] }, { "text": "修正後の完全なパッケージ番号と、その配布元のCVE対応表を照合します。古い番号のまま修正を取り込む場合があるため、数字が小さいという理由だけで未修正とは扱いません。管理者に必要な再起動の完了も確認してもらってください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53150", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-53150", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/a632bdcb359fd8145e86486ff8612da98e239acd", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/da13ade87a12dd58829278bc816a61bea06a56a9", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/ea0fa76f61cf8e932d1d26e6193513230816e11d", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/096bb5b43edf755bc4477e64004fa3a20539ec2f", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/a3dd4d63eeb452cfb064a13862fb376ab108f6a6", "label": "CVE掲載の参考情報" }, { "url": "https://lore.kernel.org/linux-cve-announce/2024122427-CVE-2024-53150-3a7d@gregkh/", "label": "CISAが示す関連情報" }, { "url": "https://source.android.com/docs/security/bulletin/2025-04-01", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53150", "label": "CISAが示す関連情報" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix out of bounds reads when finding clock sources\n\nThe current USB-audio driver code doesn't check bLength of each\ndescriptor at traversing for clock descriptors. That is, when a\ndevice provides a bogus descriptor with a shorter bLength, the driver\nmight hit out-of-bounds reads.\n\nFor addressing it, this patch adds sanity checks to the validator\nfunctions for the clock descriptor traversal. When the descriptor\nlength is shorter than expected, it's skipped in the loop.\n\nFor the clock source and clock multiplier descriptors, we can just\ncheck bLength against the sizeof() of each descriptor type.\nOTOH, the clock selector descriptor of UAC2 and UAC3 has an array\nof bNrInPins elements and two more fields at its tail, hence those\nhave to be checked in addition to the sizeof() check.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json", "sourceField": "/containers/cna/title", "excerpt": "ALSA: usb-audio: Fix out of bounds reads when finding clock sources", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53150", "sourceField": "retained:/originalText", "excerpt": "Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"sound/usb/clock.c\"],\"versions\":[{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"a632bdcb359fd8145e86486ff8612da98e239acd\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"45a92cbc88e4013bfed7fd2ccab3ade45f8e896b\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"da13ade87a12dd58829278bc816a61bea06a56a9\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"74cb86e1006c5437b1d90084d22018da30fddc77\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"ea0fa76f61cf8e932d1d26e6193513230816e11d\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"096bb5b43edf755bc4477e64004fa3a20539ec2f\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a\",\"lessThan\":\"a3dd4d63eeb452cfb064a13862fb376ab108f6a6\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"9feeaa50e5b4b0b71259d918a36ecf9059e60796\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"3b17a13b687ae99939dc94a4ae01fbc34f68decc\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"4.19.84\",\"lessThan\":\"4.20\",\"status\":\"affected\",\"versionType\":\"semver\"},{\"version\":\"5.3.11\",\"lessThan\":\"5.4\",\"status\":\"affected\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53150.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"sound/usb/clock.c\"],\"versions\":[{\"version\":\"5.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.4\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.4.287\",\"lessThanOrEqual\":\"5.4.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.10.231\",\"lessThanOrEqual\":\"5.10.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.15.174\",\"lessThanOrEqual\":\"5.15.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.64\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.11.11\",\"lessThanOrEqual\":\"6.11.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.2\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53150", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-53150\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-53150（Linux）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Linux / Linux。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、a632bdcb359fd8145e86486ff8612da98e239acd未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、45a92cbc88e4013bfed7fd2ccab3ade45f8e896b未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、da13ade87a12dd58829278bc816a61bea06a56a9未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、74cb86e1006c5437b1d90084d22018da30fddc77未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、ea0fa76f61cf8e932d1d26e6193513230816e11d未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、096bb5b43edf755bc4477e64004fa3a20539ec2f未満。影響ありとして記載：b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a以上、a3dd4d63eeb452cfb064a13862fb376ab108f6a6未満。影響ありとして記載：9feeaa50e5b4b0b71259d918a36ecf9059e60796。影響ありとして記載：3b17a13b687ae99939dc94a4ae01fbc34f68decc。影響ありとして記載：4.19.84以上、4.20未満。影響ありとして記載：5.3.11以上、5.4未満。対象のファイル：sound/usb/clock.c\n・公式の対象表：Linux / Linux。影響ありとして記載：5.4。影響なしとして記載：5.4未満の版。影響なしとして記載：5.4.287以上、5.4.*以下。影響なしとして記載：5.10.231以上、5.10.*以下。影響なしとして記載：5.15.174以上、5.15.*以下。影響なしとして記載：6.1.120以上、6.1.*以下。影響なしとして記載：6.6.64以上、6.6.*以下。影響なしとして記載：6.11.11以上、6.11.*以下。影響なしとして記載：6.12.2以上、6.12.*以下。影響なしとして記載：6.13以上（原資料の上限表記は「*」）。対象のファイル：sound/usb/clock.c。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-53150", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:04:19.685Z", "lastSuccess": "2026-10-24T06:04:19.685Z", "sourceCheckedAt": "2026-10-24T06:04:19.685Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-53197", "aliases": [], "title": "Linux：脆弱性情報", "summary": "Linux カーネルの ALSA USB オーディオドライバで、Extigy と Mbox デバイス向けに境界外アクセスの潜在的問題を修正しました。偽装デバイスが bNumConfigurations 値を過大に設定でき、usb_get_configuration が dev->config を確保する際の初期値を超えると、後で usb_destroy_configuration などで境界外アクセスが発生する可能性があります。", "risk": "物理的にシステムにアクセスできる攻撃者が悪意ある USB デバイスを使用して、システムメモリを操作したり、権限を昇格させたり、任意のコードを実行させる可能性があります。", "product": "Linux", "category": "linux", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "Linux", "cvssVector": null, "affected": [ { "product": "Linux", "range": ">= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 / < 0b4ea4bfe16566b84645ded1403756a2dc4e0f19" }, { "product": "Linux", "range": ">= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 / < 9b8460a2a7ce478e0b625af7c56d444dc24190f7" }, { "product": "Linux", "range": ">= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 / < 62dc01c83fa71e10446ee4c31e0e3d5d1291e865" }, { "product": "Linux", "range": ">= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 / < 9887d859cd60727432a01564e8f91302d361b72b" }, { "product": "Linux", "range": ">= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 / < 920a369a9f014f10ec282fd298d0666129379f1b" }, { "product": "Linux", "range": ">= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 / < b8f8b81dabe52b413fe9e062e8a852c48dd0680d" }, { "product": "Linux", "range": ">= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 / < 379d3b9799d9da953391e973b934764f01e03960" }, { "product": "Linux", "range": ">= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 / < b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca" }, { "product": "Linux", "range": ">= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 / < b909df18ce2a998afef81d58bbd1a05dc0788c40" }, { "product": "Linux", "range": "2.6.12" }, { "product": "Linux", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53197", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-53197", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/0b4ea4bfe16566b84645ded1403756a2dc4e0f19", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/9b8460a2a7ce478e0b625af7c56d444dc24190f7", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/62dc01c83fa71e10446ee4c31e0e3d5d1291e865", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/9887d859cd60727432a01564e8f91302d361b72b", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/920a369a9f014f10ec282fd298d0666129379f1b", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/b8f8b81dabe52b413fe9e062e8a852c48dd0680d", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/379d3b9799d9da953391e973b934764f01e03960", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/b909df18ce2a998afef81d58bbd1a05dc0788c40", "label": "CVE掲載の参考情報" }, { "url": "https://lore.kernel.org/linux-cve-announce/2024122725-CVE-2024-53197-6aef@gregkh/", "label": "CISAが示す関連情報" }, { "url": "https://source.android.com/docs/security/bulletin/2025-04-01", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53197", "label": "CISAが示す関連情報" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2024-12-27T13:49:39.260Z", "modifiedAt": "2026-05-11T20:52:43.330Z", "fetchedAt": "2026-10-24T04:52:37.668Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices\n\nA bogus device can provide a bNumConfigurations value that exceeds the\ninitial value used in usb_get_configuration for allocating dev->config.\n\nThis can lead to out-of-bounds accesses later, e.g. in\nusb_destroy_configuration.", "sourceTitle": "ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/usb/quirks.c" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "0b4ea4bfe16566b84645ded1403756a2dc4e0f19", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "9b8460a2a7ce478e0b625af7c56d444dc24190f7", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "62dc01c83fa71e10446ee4c31e0e3d5d1291e865", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "9887d859cd60727432a01564e8f91302d361b72b", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "920a369a9f014f10ec282fd298d0666129379f1b", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b8f8b81dabe52b413fe9e062e8a852c48dd0680d", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "379d3b9799d9da953391e973b934764f01e03960", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b909df18ce2a998afef81d58bbd1a05dc0788c40", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/usb/quirks.c" ], "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.325", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.287", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.231", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-53197", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json", "fetchedAt": "2026-10-24T04:52:37.668Z", "publishedAt": "2024-12-27T13:49:39.260Z", "modifiedAt": "2026-05-11T20:52:43.330Z", "state": "published", "provider": "Linux", "title": "ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices", "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices\n\nA bogus device can provide a bNumConfigurations value that exceeds the\ninitial value used in usb_get_configuration for allocating dev->config.\n\nThis can lead to out-of-bounds accesses later, e.g. in\nusb_destroy_configuration.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53197", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/0", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [ "sound/usb/quirks.c" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "0b4ea4bfe16566b84645ded1403756a2dc4e0f19", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "9b8460a2a7ce478e0b625af7c56d444dc24190f7", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "62dc01c83fa71e10446ee4c31e0e3d5d1291e865", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "9887d859cd60727432a01564e8f91302d361b72b", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "920a369a9f014f10ec282fd298d0666129379f1b", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b8f8b81dabe52b413fe9e062e8a852c48dd0680d", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "379d3b9799d9da953391e973b934764f01e03960", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b909df18ce2a998afef81d58bbd1a05dc0788c40", "versionType": "git", "status": "affected" } ] }, { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/1", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [ "sound/usb/quirks.c" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "2.6.12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "0", "lessThan": "2.6.12", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "4.19.325", "lessThanOrEqual": "4.19.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "5.4.287", "lessThanOrEqual": "5.4.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "5.10.231", "lessThanOrEqual": "5.10.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": "5.15.174", "lessThanOrEqual": "5.15.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": "6.1.120", "lessThanOrEqual": "6.1.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/7", "version": "6.6.64", "lessThanOrEqual": "6.6.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/8", "version": "6.11.11", "lessThanOrEqual": "6.11.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/9", "version": "6.12.2", "lessThanOrEqual": "6.12.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/10", "version": "6.13", "lessThanOrEqual": "*", "versionType": "original_commit_for_fix", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://git.kernel.org/stable/c/0b4ea4bfe16566b84645ded1403756a2dc4e0f19", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/0" }, { "url": "https://git.kernel.org/stable/c/9b8460a2a7ce478e0b625af7c56d444dc24190f7", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/1" }, { "url": "https://git.kernel.org/stable/c/62dc01c83fa71e10446ee4c31e0e3d5d1291e865", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/2" }, { "url": "https://git.kernel.org/stable/c/9887d859cd60727432a01564e8f91302d361b72b", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/3" }, { "url": "https://git.kernel.org/stable/c/920a369a9f014f10ec282fd298d0666129379f1b", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/4" }, { "url": "https://git.kernel.org/stable/c/b8f8b81dabe52b413fe9e062e8a852c48dd0680d", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/5" }, { "url": "https://git.kernel.org/stable/c/379d3b9799d9da953391e973b934764f01e03960", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/6" }, { "url": "https://git.kernel.org/stable/c/b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/7" }, { "url": "https://git.kernel.org/stable/c/b909df18ce2a998afef81d58bbd1a05dc0788c40", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/8" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53197", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"sound/usb/quirks.c\"],\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"0b4ea4bfe16566b84645ded1403756a2dc4e0f19\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"9b8460a2a7ce478e0b625af7c56d444dc24190f7\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"62dc01c83fa71e10446ee4c31e0e3d5d1291e865\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"9887d859cd60727432a01564e8f91302d361b72b\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"920a369a9f014f10ec282fd298d0666129379f1b\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b8f8b81dabe52b413fe9e062e8a852c48dd0680d\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"379d3b9799d9da953391e973b934764f01e03960\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b909df18ce2a998afef81d58bbd1a05dc0788c40\",\"status\":\"affected\",\"versionType\":\"git\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"sound/usb/quirks.c\"],\"versions\":[{\"version\":\"2.6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.12\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"4.19.325\",\"lessThanOrEqual\":\"4.19.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.4.287\",\"lessThanOrEqual\":\"5.4.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.10.231\",\"lessThanOrEqual\":\"5.10.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.15.174\",\"lessThanOrEqual\":\"5.15.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.64\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.11.11\",\"lessThanOrEqual\":\"6.11.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.2\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices\n\nA bogus device can provide a bNumConfigurations value that exceeds the\ninitial value used in usb_get_configuration for allocating dev->config.\n\nThis can lead to out-of-bounds accesses later, e.g. in\nusb_destroy_configuration.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.8,\"attackVector\":\"LOCAL\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-53197:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53197", "sourcePath": "retained:/originalText", "text": "Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-53197:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53197", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53197", "modifiedAt": "2025-04-09T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-05-11T20:52:43.330Z", "fetchedAt": "2026-10-24T04:52:37.668Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-04-09T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Linuxに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:52:37.668Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "c4537156ab6b3f0e8ff9e5c9b478e4a722df9dc1daa834e4bc15f3203157cb13", "sourceModifiedAt": "2026-05-11T20:52:43.330Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Linux カーネルの ALSA USB オーディオドライバで、Extigy と Mbox デバイス向けに境界外アクセスの潜在的問題を修正しました。偽装デバイスが bNumConfigurations 値を過大に設定でき、usb_get_configuration が dev->config を確保する際の初期値を超えると、後で usb_destroy_configuration などで境界外アクセスが発生する可能性があります。", "risk": "物理的にシステムにアクセスできる攻撃者が悪意ある USB デバイスを使用して、システムメモリを操作したり、権限を昇格させたり、任意のコードを実行させる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "攻撃者が物理的にシステムにアクセスでき、悪意ある USB デバイスを接続できることが前提条件です。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53197", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "影響範囲の記述に矛盾があり、S4 の defaultStatus は「unaffected」なのに対し、S5 の defaultStatus は「affected」となっています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json" ], "evidenceIds": [ "E4", "E5", "E2" ] }, { "text": "公式の対象表：Linux / Linux。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、0b4ea4bfe16566b84645ded1403756a2dc4e0f19未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、9b8460a2a7ce478e0b625af7c56d444dc24190f7未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、62dc01c83fa71e10446ee4c31e0e3d5d1291e865未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、9887d859cd60727432a01564e8f91302d361b72b未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、920a369a9f014f10ec282fd298d0666129379f1b未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、b8f8b81dabe52b413fe9e062e8a852c48dd0680d未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、379d3b9799d9da953391e973b934764f01e03960未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、b909df18ce2a998afef81d58bbd1a05dc0788c40未満。対象のファイル：sound/usb/quirks.c", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Linux / Linux。影響ありとして記載：2.6.12。影響なしとして記載：2.6.12未満の版。影響なしとして記載：4.19.325以上、4.19.*以下。影響なしとして記載：5.4.287以上、5.4.*以下。影響なしとして記載：5.10.231以上、5.10.*以下。影響なしとして記載：5.15.174以上、5.15.*以下。影響なしとして記載：6.1.120以上、6.1.*以下。影響なしとして記載：6.6.64以上、6.6.*以下。影響なしとして記載：6.11.11以上、6.11.*以下。影響なしとして記載：6.12.2以上、6.12.*以下。影響なしとして記載：6.13以上（原資料の上限表記は「*」）。対象のファイル：sound/usb/quirks.c。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53197" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json" ], "evidenceIds": [ "E4" ] }, { "text": "管理担当者に、Linuxの種類（Ubuntu、Red Hatなど）と版、対象パッケージ名、配布元を含む完全なパッケージ番号を確認してもらいます。OSの種類や製品の上流の番号だけで、影響の有無を決めないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "更新が用意されていない場合は、配布元や保守会社へCVE番号とパッケージ番号を送り、影響の有無・回避策・提供予定を確認します。他のLinux向けの修正をそのまま入れないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json" ], "evidenceIds": [ "E4" ] }, { "text": "修正後の完全なパッケージ番号と、その配布元のCVE対応表を照合します。古い番号のまま修正を取り込む場合があるため、数字が小さいという理由だけで未修正とは扱いません。管理者に必要な再起動の完了も確認してもらってください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53197", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-53197", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/0b4ea4bfe16566b84645ded1403756a2dc4e0f19", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/9b8460a2a7ce478e0b625af7c56d444dc24190f7", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/62dc01c83fa71e10446ee4c31e0e3d5d1291e865", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/9887d859cd60727432a01564e8f91302d361b72b", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/920a369a9f014f10ec282fd298d0666129379f1b", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/b8f8b81dabe52b413fe9e062e8a852c48dd0680d", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/379d3b9799d9da953391e973b934764f01e03960", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/b909df18ce2a998afef81d58bbd1a05dc0788c40", "label": "CVE掲載の参考情報" }, { "url": "https://lore.kernel.org/linux-cve-announce/2024122725-CVE-2024-53197-6aef@gregkh/", "label": "CISAが示す関連情報" }, { "url": "https://source.android.com/docs/security/bulletin/2025-04-01", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53197", "label": "CISAが示す関連情報" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices\n\nA bogus device can provide a bNumConfigurations value that exceeds the\ninitial value used in usb_get_configuration for allocating dev->config.\n\nThis can lead to out-of-bounds accesses later, e.g. in\nusb_destroy_configuration.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json", "sourceField": "/containers/cna/title", "excerpt": "ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53197", "sourceField": "retained:/originalText", "excerpt": "Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"sound/usb/quirks.c\"],\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"0b4ea4bfe16566b84645ded1403756a2dc4e0f19\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"9b8460a2a7ce478e0b625af7c56d444dc24190f7\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"62dc01c83fa71e10446ee4c31e0e3d5d1291e865\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"9887d859cd60727432a01564e8f91302d361b72b\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"920a369a9f014f10ec282fd298d0666129379f1b\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b8f8b81dabe52b413fe9e062e8a852c48dd0680d\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"379d3b9799d9da953391e973b934764f01e03960\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b909df18ce2a998afef81d58bbd1a05dc0788c40\",\"status\":\"affected\",\"versionType\":\"git\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/53xxx/CVE-2024-53197.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"sound/usb/quirks.c\"],\"versions\":[{\"version\":\"2.6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.12\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"4.19.325\",\"lessThanOrEqual\":\"4.19.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.4.287\",\"lessThanOrEqual\":\"5.4.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.10.231\",\"lessThanOrEqual\":\"5.10.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.15.174\",\"lessThanOrEqual\":\"5.15.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.64\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.11.11\",\"lessThanOrEqual\":\"6.11.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.2\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-53197", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-53197\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-53197（Linux）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者が物理的にシステムにアクセスでき、悪意ある USB デバイスを接続できることが前提条件です。\n・影響範囲の記述に矛盾があり、S4 の defaultStatus は「unaffected」なのに対し、S5 の defaultStatus は「affected」となっています。\n・公式の対象表：Linux / Linux。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、0b4ea4bfe16566b84645ded1403756a2dc4e0f19未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、9b8460a2a7ce478e0b625af7c56d444dc24190f7未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、62dc01c83fa71e10446ee4c31e0e3d5d1291e865未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、9887d859cd60727432a01564e8f91302d361b72b未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、920a369a9f014f10ec282fd298d0666129379f1b未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、b8f8b81dabe52b413fe9e062e8a852c48dd0680d未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、379d3b9799d9da953391e973b934764f01e03960未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca未満。影響ありとして記載：1da177e4c3f41524e886b7f1b8a0c1fc7321cac2以上、b909df18ce2a998afef81d58bbd1a05dc0788c40未満。対象のファイル：sound/usb/quirks.c\n・公式の対象表：Linux / Linux。影響ありとして記載：2.6.12。影響なしとして記載：2.6.12未満の版。影響なしとして記載：4.19.325以上、4.19.*以下。影響なしとして記載：5.4.287以上、5.4.*以下。影響なしとして記載：5.10.231以上、5.10.*以下。影響なしとして記載：5.15.174以上、5.15.*以下。影響なしとして記載：6.1.120以上、6.1.*以下。影響なしとして記載：6.6.64以上、6.6.*以下。影響なしとして記載：6.11.11以上、6.11.*以下。影響なしとして記載：6.12.2以上、6.12.*以下。影響なしとして記載：6.13以上（原資料の上限表記は「*」）。対象のファイル：sound/usb/quirks.c。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-53197", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:52:37.668Z", "lastSuccess": "2026-10-24T04:52:37.668Z", "sourceCheckedAt": "2026-10-24T04:52:37.668Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-29824", "aliases": [], "title": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2：権限の奪取", "summary": "Windows の Common Log File System ドライバーにおける Use‑After‑Free の脆弱性により、認可された攻撃者がローカルで権限を昇格させることができます。", "risk": "攻撃者がローカルで権限を昇格させることができる。", "product": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2", "category": "windows", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1507", "range": ">= 10.0.10240.0 / < 10.0.10240.20978（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.7969（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.7136（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19044.0 / < 10.0.19044.5737（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.5737（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H2", "range": ">= 10.0.22621.0 / < 10.0.22621.5189（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H3", "range": ">= 10.0.22631.0 / < 10.0.22631.5189（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.5189（環境: x64-based Systems）" }, { "product": "Windows 11 Version 24H2", "range": ">= 10.0.26100.0 / < 10.0.26100.3775（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1", "range": ">= 6.1.7601.0 / < 6.1.7601.27670（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "range": ">= 6.1.7601.0 / < 6.1.7601.27670（環境: x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.23220（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "range": ">= 6.0.6003.0 / < 6.0.6003.23220（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.25423（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.25423（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.22523（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.22523（環境: x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.7969（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.7969（環境: x64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.7136（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.7136（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.3453（環境: x64-based Systems）" }, { "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "range": ">= 10.0.25398.0 / < 10.0.25398.1551（環境: x64-based Systems）" }, { "product": "Windows Server 2025", "range": ">= 10.0.26100.0 / < 10.0.26100.3775（環境: x64-based Systems）" }, { "product": "Windows Server 2025 (Server Core installation)", "range": ">= 10.0.26100.0 / < 10.0.26100.3775（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-29824", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-29824", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29824", "label": "Windows Common Log File System Driver Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29824", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29824", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2025-04-08T17:23:34.083Z", "modifiedAt": "2026-08-10T15:12:28.880Z", "fetchedAt": "2026-10-24T04:52:46.058Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows Common Log File System Driver Elevation of Privilege Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.10240.0", "lessThan": "10.0.10240.20978", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7969", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.7136", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19044.0", "lessThan": "10.0.19044.5737", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.5737", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.22621.0", "lessThan": "10.0.22621.5189", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.5189", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.5189", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.3775", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.27670", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.27670", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.23220", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.23220", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25423", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25423", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22523", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22523", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7969", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7969", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.7136", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.7136", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.3453", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.25398.0", "lessThan": "10.0.25398.1551", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.3775", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.3775", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-29824", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "fetchedAt": "2026-10-24T04:52:46.058Z", "publishedAt": "2025-04-08T17:23:34.083Z", "modifiedAt": "2026-08-10T15:12:28.880Z", "state": "published", "provider": "microsoft", "title": "Windows Common Log File System Driver Elevation of Privilege Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-29824", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.10240.0", "lessThan": "10.0.10240.20978", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/1", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7969", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/2", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.7136", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/3", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.19044.0", "lessThan": "10.0.19044.5737", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/4", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.5737", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "sourcePath": "/containers/cna/affected/5", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.22621.0", "lessThan": "10.0.22621.5189", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "sourcePath": "/containers/cna/affected/6", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.5189", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "sourcePath": "/containers/cna/affected/7", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.5189", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "sourcePath": "/containers/cna/affected/8", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.3775", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "sourcePath": "/containers/cna/affected/9", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.27670", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "sourcePath": "/containers/cna/affected/10", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.27670", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/11", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.23220", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "sourcePath": "/containers/cna/affected/12", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/12/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.23220", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/13", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/13/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25423", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/14", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/14/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25423", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/15", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/15/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22523", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/16", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/16/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22523", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/17", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/17/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7969", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/18", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/18/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7969", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/19", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/19/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.7136", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/20", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/20/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.7136", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/21", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/21/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.3453", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "sourcePath": "/containers/cna/affected/22", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/22/versions/0", "version": "10.0.25398.0", "lessThan": "10.0.25398.1551", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "sourcePath": "/containers/cna/affected/23", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/23/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.3775", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "sourcePath": "/containers/cna/affected/24", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/24/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.3775", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-416", "lang": "en-US", "description": "CWE-416: Use After Free", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29824", "label": "Windows Common Log File System Driver Elevation of Privilege Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-29824", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-29824-windows-common-log-file-system-driver-elevation-of-privilege-vulnerability-mitigation-script", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-29824-windows-common-log-file-system-driver-elevation-of-privilege-vulnerability-detection-script", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20978\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7969\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7136\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.5737\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.5737\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.5189\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.5189\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.5189\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3775\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27670\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27670\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23220\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/12", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23220\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/13", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25423\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/14", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25423\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/15", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22523\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/16", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22523\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/17", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7969\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/18", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7969\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/19", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7136\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/20", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7136\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/21", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.3453\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/22", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.1551\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/23", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3775\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/affected/24", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3775\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-416: Use After Free\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-416\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.8,\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-29824:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-29824", "sourcePath": "retained:/originalText", "text": "Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-29824:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-29824", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-29824", "modifiedAt": "2025-04-08T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-10T15:12:28.880Z", "fetchedAt": "2026-10-24T04:52:46.058Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-04-08T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2に権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:52:46.058Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "15a74783affb8da021f5dab9d6ad0a3fe4e02f2b4c1e550fa91e4ed532d9a1b4", "sourceModifiedAt": "2026-08-10T15:12:28.880Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Windows の Common Log File System ドライバーにおける Use‑After‑Free の脆弱性により、認可された攻撃者がローカルで権限を昇格させることができます。", "risk": "攻撃者がローカルで権限を昇格させることができる。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "認可された攻撃者が対象システムにアクセスできることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20978未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7969未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.7136未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.5737未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.5737未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.5189未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.5189未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.5189未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.3775未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.27670未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.27670未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E14" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.23220未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E15" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.23220未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E16" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25423未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E17" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25423未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E18" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22523未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E19" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22523未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E20" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7969未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E21" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7969未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E22" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.7136未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E23" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.7136未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E24" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.3453未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E25" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.1551未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E26" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.3775未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E27" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.3775未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E28" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-29824" ], "evidenceIds": [ "E29" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E4" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2025-29824", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29824", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-29824", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29824", "https://nvd.nist.gov/vuln/detail/CVE-2025-29824" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json" ], "evidenceIds": [ "E4" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-29824", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-29824", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29824", "label": "Windows Common Log File System Driver Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29824", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29824", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/title", "excerpt": "Windows Common Log File System Driver Elevation of Privilege Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-29824", "sourceField": "retained:/originalText", "excerpt": "Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20978\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7969\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7136\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.5737\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.5737\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.5189\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.5189\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.5189\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3775\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27670\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27670\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23220\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/12", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23220\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/13", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25423\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/14", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25423\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/15", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22523\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/16", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22523\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/17", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7969\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/18", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7969\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/19", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7136\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/20", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7136\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E25", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/21", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.3453\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E26", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/22", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.1551\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E27", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/23", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3775\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E28", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/29xxx/CVE-2025-29824.json", "sourceField": "/containers/cna/affected/24", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3775\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E29", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-29824", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-29824\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-29824（Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認可された攻撃者が対象システムにアクセスできることが前提です。\n・公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20978未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7969未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.7136未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.5737未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.5737未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.5189未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.5189未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.5189未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.3775未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.27670未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.27670未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.23220未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.23220未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25423未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25423未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22523未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22523未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7969未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7969未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.7136未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.7136未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.3453未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.1551未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.3775未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.3775未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-29824", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:52:46.058Z", "lastSuccess": "2026-10-24T04:52:46.058Z", "sourceCheckedAt": "2026-10-24T04:52:46.058Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-30406", "aliases": [], "title": "CentreStack：コード実行", "summary": "Gladinet CentreStack 16.1.10296.56315 以前（16.4.10315.56368 で修正）では、ポータルの web.config にハードコードされた machineKey が使用されており、これを知っている脅威アクターはペイロードをシリアライズしてサーバ側でデシリアライズさせ、サーバー上でコードを実行できる（リモートコード実行）という脆弱性があります。", "risk": "この脆弱性が悪用されると、攻撃者はサーバー上で任意のコードを実行できるようになります。", "product": "CentreStack", "category": "other", "component": "package", "severity": "critical", "cvss": 9, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "CentreStack", "range": "< 16.4.10315.56368" } ], "fixed": [], "steps": [ "16.4.10315.56368 以降のバージョンにアップグレードする", "「CVE-2025-30406」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30406", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-30406", "label": "CVE公式レコード" }, { "url": "https://www.centrestack.com/p/gce_latest_release.html", "label": "CVE掲載の参考情報" }, { "url": "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf", "label": "CISAが示す関連情報" }, { "url": "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2025-triofox.pdf", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30406", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-04-03T00:00:00.000Z", "modifiedAt": "2025-10-21T22:55:22.155Z", "fetchedAt": "2026-10-24T04:52:49.037Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\\web.config.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "CentreStack", "vendor": "Gladinet", "versions": [ { "lessThan": "16.4.10315.56368", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-30406", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json", "fetchedAt": "2026-10-24T04:52:49.037Z", "publishedAt": "2025-04-03T00:00:00.000Z", "modifiedAt": "2025-10-21T22:55:22.155Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\\web.config.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30406", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Gladinet", "product": "CentreStack", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "16.4.10315.56368", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-321", "lang": "en", "description": "CWE-321 Use of Hard-coded Cryptographic Key", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9, "baseSeverity": "CRITICAL", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.centrestack.com/p/gce_latest_release.html", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30406", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"CentreStack\",\"vendor\":\"Gladinet\",\"versions\":[{\"lessThan\":\"16.4.10315.56368\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\\web.config.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-321\",\"description\":\"CWE-321 Use of Hard-coded Cryptographic Key\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":9,\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-30406:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30406", "sourcePath": "retained:/originalText", "text": "Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-30406:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30406", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30406", "modifiedAt": "2025-04-08T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T22:55:22.155Z", "fetchedAt": "2026-10-24T04:52:49.037Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-04-08T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "CentreStackにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:52:49.037Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f2cf0d3790e79907448101f8e206082543dcf4b924e9b67c677c796c020fbb2b", "sourceModifiedAt": "2025-10-21T22:55:22.155Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Gladinet CentreStack 16.1.10296.56315 以前（16.4.10315.56368 で修正）では、ポータルの web.config にハードコードされた machineKey が使用されており、これを知っている脅威アクターはペイロードをシリアライズしてサーバ側でデシリアライズさせ、サーバー上でコードを実行できる（リモートコード実行）という脆弱性があります。", "risk": "この脆弱性が悪用されると、攻撃者はサーバー上で任意のコードを実行できるようになります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "CentreStack ポータルが machineKey をハードコードしている環境", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃者がその machineKey を知っていること", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Gladinet / CentreStack。影響ありとして記載：16.4.10315.56368未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30406" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json" ], "evidenceIds": [ "E2" ] }, { "text": "「CentreStack」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-30406", "https://www.centrestack.com/p/gce_latest_release.html", "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30406", "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2025-triofox.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2025-30406" ] } ], "actions": [ { "text": "16.4.10315.56368 以降のバージョンにアップグレードする", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json" ], "evidenceIds": [ "E1" ] }, { "text": "「CVE-2025-30406」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-30406", "https://www.centrestack.com/p/gce_latest_release.html", "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30406", "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2025-triofox.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2025-30406" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-30406", "https://www.centrestack.com/p/gce_latest_release.html", "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30406", "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2025-triofox.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2025-30406" ] } ], "temporaryMitigations": [ { "text": "CentreStack 管理者が portal\\web.config に定義された machineKey を手動で削除できる", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json" ], "evidenceIds": [ "E1" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-30406", "https://www.centrestack.com/p/gce_latest_release.html", "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30406", "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2025-triofox.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2025-30406" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30406", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-30406", "label": "CVE公式レコード" }, { "url": "https://www.centrestack.com/p/gce_latest_release.html", "label": "CVE掲載の参考情報" }, { "url": "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf", "label": "CISAが示す関連情報" }, { "url": "https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2025-triofox.pdf", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30406", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\\web.config.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30406.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"CentreStack\",\"vendor\":\"Gladinet\",\"versions\":[{\"lessThan\":\"16.4.10315.56368\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30406", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-30406\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-30406（CentreStack）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・CentreStack ポータルが machineKey をハードコードしている環境\n・攻撃者がその machineKey を知っていること\n・公式の対象表：Gladinet / CentreStack。影響ありとして記載：16.4.10315.56368未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-30406", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:52:49.037Z", "lastSuccess": "2026-10-24T04:52:49.037Z", "sourceCheckedAt": "2026-10-24T04:52:49.037Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-31161", "aliases": [], "title": "CrushFTP：認証の回避", "summary": "CrushFTP 10 系列（10.8.4 未満）および 11 系列（11.3.1 未満）では、HTTP コンポーネントの AWS4‑HMAC 認証方式にレースコンディションがあり、パスワード不要でユーザーの存在確認が行われた後、署名ヘッダーが欠落するとインデックス範囲外エラーが発生し、セッションのクリーンアップが行われません。この欠陥により、攻撃者は任意の既知または推測可能なユーザー（例: crushadmin）として認証でき、管理者アカウントを取得してシステムを完全に乗っ取ることが容易になります。", "risk": "認証バイパスに成功すると、攻撃者は管理者アカウントを取得でき、システム全体が乗っ取られる可能性があります。", "product": "CrushFTP", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "CrushFTP", "range": ">= 10 / < 10.8.4" }, { "product": "CrushFTP", "range": ">= 11 / < 11.3.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31161", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-31161", "label": "CVE公式レコード" }, { "url": "https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/", "label": "CVE掲載の参考情報" }, { "url": "https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo", "label": "CVE掲載の参考情報" }, { "url": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31161", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-04-03T00:00:00.000Z", "modifiedAt": "2025-10-21T22:55:22.326Z", "fetchedAt": "2026-10-24T04:52:50.116Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka \"Unauthenticated HTTP(S) port access.\" A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "CrushFTP", "vendor": "CrushFTP", "versions": [ { "lessThan": "10.8.4", "status": "affected", "version": "10", "versionType": "custom" }, { "lessThan": "11.3.1", "status": "affected", "version": "11", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-31161", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json", "fetchedAt": "2026-10-24T04:52:50.116Z", "publishedAt": "2025-04-03T00:00:00.000Z", "modifiedAt": "2025-10-21T22:55:22.326Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka \"Unauthenticated HTTP(S) port access.\" A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31161", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "CrushFTP", "product": "CrushFTP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10", "lessThan": "10.8.4", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "11", "lessThan": "11.3.1", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-305", "lang": "en", "description": "CWE-305 Authentication Bypass by Primary Weakness", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://projectdiscovery.io/blog/crushftp-authentication-bypass", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.darkreading.com/vulnerabilities-threats/disclosure-drama-clouds-crushftp-vulnerability-exploitation", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://www.infosecurity-magazine.com/news/crushftp-flaw-exploited-disclosure/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-31161-detect-crushftp-vulnerability", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-31161-mitigate-crushftp-vulnerability", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31161", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"CrushFTP\",\"vendor\":\"CrushFTP\",\"versions\":[{\"lessThan\":\"10.8.4\",\"status\":\"affected\",\"version\":\"10\",\"versionType\":\"custom\"},{\"lessThan\":\"11.3.1\",\"status\":\"affected\",\"version\":\"11\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka \"Unauthenticated HTTP(S) port access.\" A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-305\",\"description\":\"CWE-305 Authentication Bypass by Primary Weakness\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-31161:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31161", "sourcePath": "retained:/originalText", "text": "CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-31161:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31161", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31161", "modifiedAt": "2025-04-07T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T22:55:22.326Z", "fetchedAt": "2026-10-24T04:52:50.116Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-04-07T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "CrushFTPに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:52:50.116Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "c66c0490b3f57a71f605bb8ed63c5f9ff4dde5728435d0e913af80a87dd5230c", "sourceModifiedAt": "2025-10-21T22:55:22.326Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "CrushFTP 10 系列（10.8.4 未満）および 11 系列（11.3.1 未満）では、HTTP コンポーネントの AWS4‑HMAC 認証方式にレースコンディションがあり、パスワード不要でユーザーの存在確認が行われた後、署名ヘッダーが欠落するとインデックス範囲外エラーが発生し、セッションのクリーンアップが行われません。この欠陥により、攻撃者は任意の既知または推測可能なユーザー（例: crushadmin）として認証でき、管理者アカウントを取得してシステムを完全に乗っ取ることが容易になります。", "risk": "認証バイパスに成功すると、攻撃者は管理者アカウントを取得でき、システム全体が乗っ取られる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "攻撃者はリモートの認証されていないユーザーである必要があります。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31161" ], "evidenceIds": [ "E2" ] }, { "text": "DMZ プロキシインスタンスが使用されていない環境でのみ脆弱性が成立します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象となるのは HTTP(S) ポートが外部からアクセス可能で、かつ AWS4‑HMAC 認証方式が使用されている CrushFTP のインスタンスです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：CrushFTP / CrushFTP。影響ありとして記載：10以上、10.8.4未満。影響ありとして記載：11以上、11.3.1未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31161" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json" ], "evidenceIds": [ "E3" ] }, { "text": "「CrushFTP」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-31161", "https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/", "https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31161", "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update", "https://nvd.nist.gov/vuln/detail/CVE-2025-31161" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-31161", "https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/", "https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31161", "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update", "https://nvd.nist.gov/vuln/detail/CVE-2025-31161" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-31161", "https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/", "https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31161", "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update", "https://nvd.nist.gov/vuln/detail/CVE-2025-31161" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31161", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-31161", "label": "CVE公式レコード" }, { "url": "https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/", "label": "CVE掲載の参考情報" }, { "url": "https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo", "label": "CVE掲載の参考情報" }, { "url": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31161", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka \"Unauthenticated HTTP(S) port access.\" A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31161", "sourceField": "retained:/originalText", "excerpt": "CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/31xxx/CVE-2025-31161.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"CrushFTP\",\"vendor\":\"CrushFTP\",\"versions\":[{\"lessThan\":\"10.8.4\",\"status\":\"affected\",\"version\":\"10\",\"versionType\":\"custom\"},{\"lessThan\":\"11.3.1\",\"status\":\"affected\",\"version\":\"11\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31161", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-31161\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-31161（CrushFTP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者はリモートの認証されていないユーザーである必要があります。\n・DMZ プロキシインスタンスが使用されていない環境でのみ脆弱性が成立します。\n・対象となるのは HTTP(S) ポートが外部からアクセス可能で、かつ AWS4‑HMAC 認証方式が使用されている CrushFTP のインスタンスです。\n・公式の対象表：CrushFTP / CrushFTP。影響ありとして記載：10以上、10.8.4未満。影響ありとして記載：11以上、11.3.1未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-31161", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:52:50.116Z", "lastSuccess": "2026-10-24T04:52:50.116Z", "sourceCheckedAt": "2026-10-24T04:52:50.116Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-22457", "aliases": [], "title": "Connect Secure / Policy Secure / Neurons for ZTA gateways：コード実行", "summary": "Ivanti Connect Secure、Policy Secure、ZTA Gateways において、スタックベースのバッファオーバーフローが存在し、リモートの認証されていない攻撃者がリモートコード実行を行える可能性があります。", "risk": "攻撃者がコードを実行できるようになると、サーバーや機器上で任意の処理を行わせられ、システムの制御が奪われる恐れがあります。", "product": "Connect Secure / Policy Secure / Neurons for ZTA gateways", "category": "other", "component": "package", "severity": "critical", "cvss": 9, "cvssVersion": "3.1", "cvssSource": "ivanti", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Connect Secure", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" }, { "product": "Policy Secure", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" }, { "product": "Neurons for ZTA gateways", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "CISA が示す指示に従って緩和策を適用してください。", "「CVE-2025-22457」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json", "label": "CVE：ivanti" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-22457", "label": "CVE公式レコード" }, { "url": "https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-22457", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22457", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-04-03T15:20:23.628Z", "modifiedAt": "2026-08-04T03:55:47.416Z", "fetchedAt": "2026-10-24T04:52:55.044Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "Connect Secure", "vendor": "Ivanti", "versions": [ { "status": "unaffected", "version": "22.7R2.6", "versionType": "custom" } ] }, { "defaultStatus": "affected", "product": "Policy Secure", "vendor": "Ivanti", "versions": [ { "status": "unaffected", "version": "22.7R1.4", "versionType": "custom" } ] }, { "defaultStatus": "affected", "product": "Neurons for ZTA gateways", "vendor": "Ivanti", "versions": [ { "status": "unaffected", "version": "22.8R2.2", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-22457", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json", "fetchedAt": "2026-10-24T04:52:55.044Z", "publishedAt": "2025-04-03T15:20:23.628Z", "modifiedAt": "2026-08-04T03:55:47.416Z", "state": "published", "provider": "ivanti", "title": "", "descriptions": [ { "lang": "en", "value": "A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Ivanti", "product": "Connect Secure", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "22.7R2.6", "versionType": "custom", "status": "unaffected" } ] }, { "vendor": "Ivanti", "product": "Policy Secure", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "22.7R1.4", "versionType": "custom", "status": "unaffected" } ] }, { "vendor": "Ivanti", "product": "Neurons for ZTA gateways", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "22.8R2.2", "versionType": "custom", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-121", "lang": "en", "description": "CWE-121 Stack-based Buffer Overflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9, "baseSeverity": "CRITICAL", "provider": "ivanti", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457", "label": "ivanti", "tags": [], "provider": "ivanti", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22457", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"Connect Secure\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"22.7R2.6\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"defaultStatus\":\"affected\",\"product\":\"Policy Secure\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"22.7R1.4\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"defaultStatus\":\"affected\",\"product\":\"Neurons for ZTA gateways\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"22.8R2.2\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-121\",\"description\":\"CWE-121 Stack-based Buffer Overflow\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-22457:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "sourcePath": "retained:/originalText", "text": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-22457:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations as set forth in the CISA instructions linked below.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "modifiedAt": "2025-04-04T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-04T03:55:47.416Z", "fetchedAt": "2026-10-24T04:52:55.044Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-04-04T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations as set forth in the CISA instructions linked below.", "sourceSummary": "Connect Secure / Policy Secure / Neurons for ZTA gatewaysにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:52:55.044Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "464a6ce293f95a704152391b5ab2337edecdbbe47857cd1b9c44ada01af44fb6", "sourceModifiedAt": "2026-08-04T03:55:47.416Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Ivanti Connect Secure、Policy Secure、ZTA Gateways において、スタックベースのバッファオーバーフローが存在し、リモートの認証されていない攻撃者がリモートコード実行を行える可能性があります。", "risk": "攻撃者がコードを実行できるようになると、サーバーや機器上で任意の処理を行わせられ、システムの制御が奪われる恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "リモートの認証されていない攻撃者が対象製品に対して特別な権限やユーザー操作なしに攻撃を実行できることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Ivanti / Connect Secure。影響なしとして記載：22.7R2.6。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Ivanti / Policy Secure。影響なしとして記載：22.7R1.4。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Ivanti / Neurons for ZTA gateways。影響なしとして記載：22.8R2.2。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457" ], "evidenceIds": [ "E8" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Connect Secure / Policy Secure / Neurons for ZTA gateways」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-22457", "https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-22457", "https://nvd.nist.gov/vuln/detail/CVE-2025-22457" ] } ], "actions": [ { "text": "CISA が示す指示に従って緩和策を適用してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457" ], "evidenceIds": [ "E6", "E7" ] }, { "text": "「CVE-2025-22457」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-22457", "https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-22457", "https://nvd.nist.gov/vuln/detail/CVE-2025-22457" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-22457", "https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-22457", "https://nvd.nist.gov/vuln/detail/CVE-2025-22457" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-22457", "https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-22457", "https://nvd.nist.gov/vuln/detail/CVE-2025-22457" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-22457", "https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-22457", "https://nvd.nist.gov/vuln/detail/CVE-2025-22457" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json", "label": "CVE：ivanti" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-22457", "label": "CVE公式レコード" }, { "url": "https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-22457", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22457", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "sourceField": "retained:/originalText", "excerpt": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"Connect Secure\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"22.7R2.6\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"Policy Secure\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"22.7R1.4\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/22xxx/CVE-2025-22457.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"Neurons for ZTA gateways\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"22.8R2.2\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations as set forth in the CISA instructions linked below.", "language": null, "representation": "retained_feed_field" }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "sourceField": "/sourceAction", "excerpt": "Apply mitigations as set forth in the CISA instructions linked below.", "language": null }, { "id": "E8", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-22457\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-22457（Connect Secure / Policy Secure / Neurons for ZTA gateways）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートの認証されていない攻撃者が対象製品に対して特別な権限やユーザー操作なしに攻撃を実行できることが前提です。\n・公式の対象表：Ivanti / Connect Secure。影響なしとして記載：22.7R2.6。個別に例外が記されていない版も、原資料では影響ありとされています。\n・公式の対象表：Ivanti / Policy Secure。影響なしとして記載：22.7R1.4。個別に例外が記されていない版も、原資料では影響ありとされています。\n・公式の対象表：Ivanti / Neurons for ZTA gateways。影響なしとして記載：22.8R2.2。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-22457", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:52:55.044Z", "lastSuccess": "2026-10-24T04:52:55.044Z", "sourceCheckedAt": "2026-10-24T04:52:55.044Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-24813", "aliases": [], "title": "Apache Tomcat：コード実行", "summary": "Apache Tomcat のデフォルトサーブレットで書き込みが有効（デフォルトでは無効）かつ部分 PUT が有効（デフォルトで有効）な場合、特定の条件がすべて満たされると、リモートコード実行や情報漏洩、アップロードされたファイルへの悪意あるコンテンツの追加が可能になる。", "risk": "攻撃者はサーバー上で任意のコードを実行したり、機密ファイルを閲覧したり、アップロードされたファイルに悪意あるコンテンツを注入したりできる。", "product": "Apache Tomcat", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apache", "cvssVector": null, "affected": [ { "product": "Apache Tomcat", "range": ">= 11.0.0-M1 / <= 11.0.2" }, { "product": "Apache Tomcat", "range": ">= 10.1.0-M1 / <= 10.1.34" }, { "product": "Apache Tomcat", "range": ">= 9.0.0.M1 / <= 9.0.98" }, { "product": "Apache Tomcat", "range": ">= 8.5.0 / <= 8.5.100" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json", "label": "CVE：apache" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24813", "label": "CVE公式レコード" }, { "url": "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24813", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-10T16:44:03.715Z", "modifiedAt": "2025-10-29T11:49:44.413Z", "fetchedAt": "2026-10-24T04:53:03.830Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.", "sourceTitle": "Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Apache Tomcat", "vendor": "Apache Software Foundation", "versions": [ { "lessThanOrEqual": "11.0.2", "status": "affected", "version": "11.0.0-M1", "versionType": "semver" }, { "lessThanOrEqual": "10.1.34", "status": "affected", "version": "10.1.0-M1", "versionType": "semver" }, { "lessThanOrEqual": "9.0.98", "status": "affected", "version": "9.0.0.M1", "versionType": "semver" }, { "lessThanOrEqual": "8.5.100", "status": "affected", "version": "8.5.0", "versionType": "semver" }, { "lessThan": "8.5.0", "status": "unknown", "version": "3", "versionType": "semver" }, { "lessThanOrEqual": "10.0.27", "status": "unknown", "version": "10.0.0-M1", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-24813", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json", "fetchedAt": "2026-10-24T04:53:03.830Z", "publishedAt": "2025-03-10T16:44:03.715Z", "modifiedAt": "2025-10-29T11:49:44.413Z", "state": "published", "provider": "apache", "title": "Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "descriptions": [ { "lang": "en", "value": "Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "11.0.0-M1", "lessThanOrEqual": "11.0.2", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "10.1.0-M1", "lessThanOrEqual": "10.1.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "9.0.0.M1", "lessThanOrEqual": "9.0.98", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "3", "lessThan": "8.5.0", "versionType": "semver", "status": "unknown" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "10.0.0-M1", "lessThanOrEqual": "10.0.27", "versionType": "semver", "status": "unknown" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-44", "lang": "en", "description": "CWE-44 Path Equivalence: 'file.name' (Internal Dot)", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-502", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq", "label": "apache", "tags": [ "vendor-advisory" ], "provider": "apache", "sourcePath": "/containers/cna/references/0" }, { "url": "http://www.openwall.com/lists/oss-security/2025/03/10/5", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://security.netapp.com/advisory/ntap-20250321-0001/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Apache Tomcat\",\"vendor\":\"Apache Software Foundation\",\"versions\":[{\"lessThanOrEqual\":\"11.0.2\",\"status\":\"affected\",\"version\":\"11.0.0-M1\",\"versionType\":\"semver\"},{\"lessThanOrEqual\":\"10.1.34\",\"status\":\"affected\",\"version\":\"10.1.0-M1\",\"versionType\":\"semver\"},{\"lessThanOrEqual\":\"9.0.98\",\"status\":\"affected\",\"version\":\"9.0.0.M1\",\"versionType\":\"semver\"},{\"lessThanOrEqual\":\"8.5.100\",\"status\":\"affected\",\"version\":\"8.5.0\",\"versionType\":\"semver\"},{\"lessThan\":\"8.5.0\",\"status\":\"unknown\",\"version\":\"3\",\"versionType\":\"semver\"},{\"lessThanOrEqual\":\"10.0.27\",\"status\":\"unknown\",\"version\":\"10.0.0-M1\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-44\",\"description\":\"CWE-44 Path Equivalence: 'file.name' (Internal Dot)\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"cweId\":\"CWE-502\",\"description\":\"CWE-502 Deserialization of Untrusted Data\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"CHANGED\",\"version\":\"3.1\",\"baseScore\":10,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-24813:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813", "sourcePath": "retained:/originalText", "text": "Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-24813:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813", "modifiedAt": "2025-04-01T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-29T11:49:44.413Z", "fetchedAt": "2026-10-24T04:53:03.830Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-04-01T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Apache Tomcatにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:53:03.830Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "88add2faff8188bfd3b4326a98b57493168d855900d36fe067c6599304e96a46", "sourceModifiedAt": "2025-10-29T11:49:44.413Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Apache Tomcat のデフォルトサーブレットで書き込みが有効（デフォルトでは無効）かつ部分 PUT が有効（デフォルトで有効）な場合、特定の条件がすべて満たされると、リモートコード実行や情報漏洩、アップロードされたファイルへの悪意あるコンテンツの追加が可能になる。", "risk": "攻撃者はサーバー上で任意のコードを実行したり、機密ファイルを閲覧したり、アップロードされたファイルに悪意あるコンテンツを注入したりできる。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "情報漏洩または悪意あるコンテンツの追加が可能になる条件：\n- デフォルトサーブレットの書き込みが有効（デフォルトでは無効）\n- 部分 PUT が有効（デフォルトで有効）\n- 機密ファイル用のアップロード先 URL が公開アップロード先 URL のサブディレクトリになっている\n- 攻撃者が機密ファイルの名前を把握している\n- 機密ファイルが部分 PUT でアップロードされている", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "リモートコード実行が可能になる条件：\n- デフォルトサーブレットの書き込みが有効（デフォルトでは無効）\n- 部分 PUT が有効（デフォルトで有効）\n- アプリケーションが Tomcat のファイルベースのセッション永続化をデフォルトの保存場所で使用している\n- アプリケーションがデシリアライズ攻撃に利用できるライブラリを組み込んでいる", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Apache Software Foundation / Apache Tomcat。影響ありとして記載：11.0.0-M1以上、11.0.2以下。影響ありとして記載：10.1.0-M1以上、10.1.34以下。影響ありとして記載：9.0.0.M1以上、9.0.98以下。影響ありとして記載：8.5.0以上、8.5.100以下。影響は未確定として記載：3以上、8.5.0未満。影響は未確定として記載：10.0.0-M1以上、10.0.27以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json" ], "evidenceIds": [ "E4" ] }, { "text": "「Apache Tomcat」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-24813", "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813", "https://nvd.nist.gov/vuln/detail/CVE-2025-24813" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-24813", "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813", "https://nvd.nist.gov/vuln/detail/CVE-2025-24813" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-24813", "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813", "https://nvd.nist.gov/vuln/detail/CVE-2025-24813" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json", "label": "CVE：apache" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24813", "label": "CVE公式レコード" }, { "url": "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24813", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json", "sourceField": "/containers/cna/title", "excerpt": "Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813", "sourceField": "retained:/originalText", "excerpt": "Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Apache Tomcat\",\"vendor\":\"Apache Software Foundation\",\"versions\":[{\"lessThanOrEqual\":\"11.0.2\",\"status\":\"affected\",\"version\":\"11.0.0-M1\",\"versionType\":\"semver\"},{\"lessThanOrEqual\":\"10.1.34\",\"status\":\"affected\",\"version\":\"10.1.0-M1\",\"versionType\":\"semver\"},{\"lessThanOrEqual\":\"9.0.98\",\"status\":\"affected\",\"version\":\"9.0.0.M1\",\"versionType\":\"semver\"},{\"lessThanOrEqual\":\"8.5.100\",\"status\":\"affected\",\"version\":\"8.5.0\",\"versionType\":\"semver\"},{\"lessThan\":\"8.5.0\",\"status\":\"unknown\",\"version\":\"3\",\"versionType\":\"semver\"},{\"lessThanOrEqual\":\"10.0.27\",\"status\":\"unknown\",\"version\":\"10.0.0-M1\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-24813\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-24813（Apache Tomcat）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・情報漏洩または悪意あるコンテンツの追加が可能になる条件：\n- デフォルトサーブレットの書き込みが有効（デフォルトでは無効）\n- 部分 PUT が有効（デフォルトで有効）\n- 機密ファイル用のアップロード先 URL が公開アップロード先 URL のサブディレクトリになっている\n- 攻撃者が機密ファイルの名前を把握している\n- 機密ファイルが部分 PUT でアップロードされている\n・リモートコード実行が可能になる条件：\n- デフォルトサーブレットの書き込みが有効（デフォルトでは無効）\n- 部分 PUT が有効（デフォルトで有効）\n- アプリケーションが Tomcat のファイルベースのセッション永続化をデフォルトの保存場所で使用している\n- アプリケーションがデシリアライズ攻撃に利用できるライブラリを組み込んでいる\n・公式の対象表：Apache Software Foundation / Apache Tomcat。影響ありとして記載：11.0.0-M1以上、11.0.2以下。影響ありとして記載：10.1.0-M1以上、10.1.34以下。影響ありとして記載：9.0.0.M1以上、9.0.98以下。影響ありとして記載：8.5.0以上、8.5.100以下。影響は未確定として記載：3以上、8.5.0未満。影響は未確定として記載：10.0.0-M1以上、10.0.27以下。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-24813", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:53:03.830Z", "lastSuccess": "2026-10-24T04:53:03.830Z", "sourceCheckedAt": "2026-10-24T04:53:03.830Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2024-20439", "aliases": [], "title": "Cisco Smart License Utility：脆弱性情報", "summary": "Cisco Smart Licensing Utility に未公開の静的管理者クレデンシャルが存在し、認証されていないリモート攻撃者がそれを使用してシステムにログインできる脆弱性があります。", "risk": "攻撃者は CSLU アプリケーション API に対して管理者権限でログインできるようになります。", "product": "Cisco Smart License Utility", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Cisco Smart License Utility", "range": "2.1.0" }, { "product": "Cisco Smart License Utility", "range": "2.0.0" }, { "product": "Cisco Smart License Utility", "range": "2.2.0" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20439", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-20439", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20439", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-09-04T16:28:39.669Z", "modifiedAt": "2025-10-21T22:55:46.010Z", "fetchedAt": "2026-10-24T04:53:05.005Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential.\r\n\r This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "Cisco Smart License Utility", "versions": [ { "version": "2.1.0", "status": "affected" }, { "version": "2.0.0", "status": "affected" }, { "version": "2.2.0", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-20439", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json", "fetchedAt": "2026-10-24T04:53:05.005Z", "publishedAt": "2024-09-04T16:28:39.669Z", "modifiedAt": "2025-10-21T22:55:46.010Z", "state": "published", "provider": "cisco", "title": "", "descriptions": [ { "lang": "en", "value": "A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential.\r\n\r This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20439", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Cisco", "product": "Cisco Smart License Utility", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "2.1.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "2.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "2.2.0", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "In March 2025, the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of this vulnerability in the wild. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-912", "lang": "en", "description": "Hidden Functionality", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw", "label": "cisco-sa-cslu-7gHMzWmw", "tags": [], "provider": "cisco", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20439", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Smart License Utility\",\"versions\":[{\"version\":\"2.1.0\",\"status\":\"affected\"},{\"version\":\"2.0.0\",\"status\":\"affected\"},{\"version\":\"2.2.0\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential.\r\n\r This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "In March 2025, the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of this vulnerability in the wild. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Hidden Functionality\",\"type\":\"cwe\",\"cweId\":\"CWE-912\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-20439:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20439", "sourcePath": "retained:/originalText", "text": "Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-20439:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20439", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20439", "modifiedAt": "2025-03-31T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T22:55:46.010Z", "fetchedAt": "2026-10-24T04:53:05.005Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-31T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Cisco Smart License Utilityに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:53:05.005Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d13d87d75b416704a4c5a250b1c922a54811030c40132ee24a408f915e5eabd8", "sourceModifiedAt": "2025-10-21T22:55:46.010Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco Smart Licensing Utility に未公開の静的管理者クレデンシャルが存在し、認証されていないリモート攻撃者がそれを使用してシステムにログインできる脆弱性があります。", "risk": "攻撃者は CSLU アプリケーション API に対して管理者権限でログインできるようになります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証されていないリモート攻撃者が、未公開の静的管理者クレデンシャルを使用してログインできることが前提条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Cisco / Cisco Smart License Utility。影響ありとして記載：2.1.0。影響ありとして記載：2.0.0。影響ありとして記載：2.2.0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20439" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Cisco Smart License Utility」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-20439", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20439", "https://nvd.nist.gov/vuln/detail/CVE-2024-20439" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-20439", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20439", "https://nvd.nist.gov/vuln/detail/CVE-2024-20439" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-20439", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20439", "https://nvd.nist.gov/vuln/detail/CVE-2024-20439" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20439", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-20439", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20439", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential.\r\n\r This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20439.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Smart License Utility\",\"versions\":[{\"version\":\"2.1.0\",\"status\":\"affected\"},{\"version\":\"2.0.0\",\"status\":\"affected\"},{\"version\":\"2.2.0\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20439", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-20439\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-20439（Cisco Smart License Utility）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていないリモート攻撃者が、未公開の静的管理者クレデンシャルを使用してログインできることが前提条件です。\n・公式の対象表：Cisco / Cisco Smart License Utility。影響ありとして記載：2.1.0。影響ありとして記載：2.0.0。影響ありとして記載：2.2.0。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-20439", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:53:05.005Z", "lastSuccess": "2026-10-24T04:53:05.005Z", "sourceCheckedAt": "2026-10-24T04:53:05.005Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-2783", "aliases": [], "title": "Chrome：脆弱性情報", "summary": "Google Chrome の Windows 版において、Mojo のハンドルが不適切に処理される条件下で、リモートの攻撃者が悪意のあるファイルを用いてサンドボックスから脱出できる脆弱性が存在します。", "risk": "攻撃者はサンドボックスを抜けて、Chrome が実行している権限でコードを実行できる可能性があります。", "product": "Chrome", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "Chrome", "cvssVector": null, "affected": [ { "product": "Chrome", "range": ">= 134.0.6998.177 / < 134.0.6998.177" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2783", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-2783", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/405143032", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2783", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-26T16:07:51.034Z", "modifiedAt": "2026-02-26T19:09:11.033Z", "fetchedAt": "2026-10-24T08:41:49.162Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Google", "product": "Chrome", "versions": [ { "version": "134.0.6998.177", "status": "affected", "lessThan": "134.0.6998.177", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-2783", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json", "fetchedAt": "2026-10-24T08:41:49.162Z", "publishedAt": "2025-03-26T16:07:51.034Z", "modifiedAt": "2026-02-26T19:09:11.033Z", "state": "published", "provider": "Chrome", "title": "", "descriptions": [ { "lang": "en", "value": "Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2783", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Google", "product": "Chrome", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "134.0.6998.177", "lessThan": "134.0.6998.177", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Incorrect handle provided in unspecified circumstances", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 8.3, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/0" }, { "url": "https://issues.chromium.org/issues/405143032", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2783", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"134.0.6998.177\",\"status\":\"affected\",\"lessThan\":\"134.0.6998.177\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Incorrect handle provided in unspecified circumstances\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"CHANGED\",\"version\":\"3.1\",\"baseScore\":8.3,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-2783:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2783", "sourcePath": "retained:/originalText", "text": "Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-2783:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2783", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2783", "modifiedAt": "2025-03-27T00:00:00.000Z", "fetchedAt": "2026-10-24T08:17:50.152Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T19:09:11.033Z", "fetchedAt": "2026-10-24T08:41:49.162Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-27T00:00:00.000Z", "fetchedAt": "2026-10-24T08:17:50.152Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Chromeに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T08:41:49.162Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "900270acc24dfa578694a6f0e6ddbef2b40ebf372bc0ce62574b297fb5220afb", "sourceModifiedAt": "2026-02-26T19:09:11.033Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Google Chrome の Windows 版において、Mojo のハンドルが不適切に処理される条件下で、リモートの攻撃者が悪意のあるファイルを用いてサンドボックスから脱出できる脆弱性が存在します。", "risk": "攻撃者はサンドボックスを抜けて、Chrome が実行している権限でコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は Windows 上の Google Chrome ですが、構造化された対象情報 (S4) はバージョン \"134.0.6998.177\" と lessThan \"134.0.6998.177\" が同一であり、実際には有効なバージョン範囲が存在しない（空範囲）と解釈されます。この点は記述と矛盾しています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも134.0.6998.177で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2783" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Chrome」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-2783", "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html", "https://issues.chromium.org/issues/405143032", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2783", "https://nvd.nist.gov/vuln/detail/CVE-2025-2783" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-2783", "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html", "https://issues.chromium.org/issues/405143032", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2783", "https://nvd.nist.gov/vuln/detail/CVE-2025-2783" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-2783", "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html", "https://issues.chromium.org/issues/405143032", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2783", "https://nvd.nist.gov/vuln/detail/CVE-2025-2783" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2783", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-2783", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/405143032", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2783", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2783.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"134.0.6998.177\",\"status\":\"affected\",\"lessThan\":\"134.0.6998.177\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2783", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-2783\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-2783（Chrome）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は Windows 上の Google Chrome ですが、構造化された対象情報 (S4) はバージョン \"134.0.6998.177\" と lessThan \"134.0.6998.177\" が同一であり、実際には有効なバージョン範囲が存在しない（空範囲）と解釈されます。この点は記述と矛盾しています。\n・公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも134.0.6998.177で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-2783", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T08:41:49.162Z", "lastSuccess": "2026-10-24T08:41:49.162Z", "sourceCheckedAt": "2026-10-24T08:41:49.162Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2019-9874", "aliases": [], "title": "n/a：コード実行", "summary": "Sitecore CMS 7.0 から 7.2、Sitecore Experience Platform (XP) 7.5 から 8.2 の Sitecore.Security.AntiCSRF（アンチ CSRF）モジュールで、信頼できないデータの逆シリアル化が可能となり、認証されていない攻撃者が HTTP POST パラメータ __CSRFTOKEN にシリアライズされた .NET オブジェクトを送信することで任意のコードを実行できる。", "risk": "認証されていない攻撃者が任意のコードを実行できるため、サーバー上で攻撃者の意図した処理が行われる可能性がある。", "product": "Sitecore CMS and Experience Platform (XP)", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-9874", "label": "CVE公式レコード" }, { "url": "https://dev.sitecore.net/Downloads.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/blog.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "label": "CVE掲載の参考情報" }, { "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9874", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2019-05-31T20:11:49.000Z", "modifiedAt": "2025-10-21T23:45:35.994Z", "fetchedAt": "2026-10-24T04:53:05.945Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2019-9874", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "fetchedAt": "2026-10-24T04:53:05.945Z", "publishedAt": "2019-05-31T20:11:49.000Z", "modifiedAt": "2025-10-21T23:45:35.994Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://dev.sitecore.net/Downloads.aspx", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.synacktiv.com/blog.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9874", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2019-9874:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "sourcePath": "retained:/originalText", "text": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2019-9874:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "modifiedAt": "2025-03-26T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:45:35.994Z", "fetchedAt": "2026-10-24T04:53:05.945Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-26T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:53:05.945Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "330db264fe1c62d7a9238f9e0d5bca367e87fced53f83682eb91cae00b2982ef", "sourceModifiedAt": "2025-10-21T23:45:35.994Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Sitecore CMS 7.0 から 7.2、Sitecore Experience Platform (XP) 7.5 から 8.2 の Sitecore.Security.AntiCSRF（アンチ CSRF）モジュールで、信頼できないデータの逆シリアル化が可能となり、認証されていない攻撃者が HTTP POST パラメータ __CSRFTOKEN にシリアライズされた .NET オブジェクトを送信することで任意のコードを実行できる。", "risk": "認証されていない攻撃者が任意のコードを実行できるため、サーバー上で攻撃者の意図した処理が行われる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "対象製品は Sitecore CMS バージョン 7.0 から 7.2、Sitecore Experience Platform (XP) バージョン 7.5 から 8.2 である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃者は認証されていない状態で、HTTP POST パラメータ __CSRFTOKEN にシリアライズされた .NET オブジェクトを送信できる必要がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Sitecore CMS and Experience Platform (XP)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-9874", "https://dev.sitecore.net/Downloads.aspx", "https://www.synacktiv.com/blog.html", "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035", "https://nvd.nist.gov/vuln/detail/CVE-2019-9874" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2019-9874", "https://dev.sitecore.net/Downloads.aspx", "https://www.synacktiv.com/blog.html", "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035", "https://nvd.nist.gov/vuln/detail/CVE-2019-9874" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-9874", "https://dev.sitecore.net/Downloads.aspx", "https://www.synacktiv.com/blog.html", "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035", "https://nvd.nist.gov/vuln/detail/CVE-2019-9874" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-9874", "label": "CVE公式レコード" }, { "url": "https://dev.sitecore.net/Downloads.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/blog.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "label": "CVE掲載の参考情報" }, { "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9874", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "sourceField": "retained:/originalText", "excerpt": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2019-9874\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2019-9874（Sitecore CMS and Experience Platform (XP)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象製品は Sitecore CMS バージョン 7.0 から 7.2、Sitecore Experience Platform (XP) バージョン 7.5 から 8.2 である。\n・攻撃者は認証されていない状態で、HTTP POST パラメータ __CSRFTOKEN にシリアライズされた .NET オブジェクトを送信できる必要がある。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2019-9874", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:53:05.945Z", "lastSuccess": "2026-10-24T04:53:05.945Z", "sourceCheckedAt": "2026-10-24T04:53:05.945Z", "errorCode": null }, "glossary": [ { "term": "CSRF", "meaning": "ログイン中の人のブラウザーを利用して、その人が意図しない操作をサイトへ送らせる問題です。本人の操作やログインが必要かは、個別の条件を確認します。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF", "kind": "general_definition" }, { "term": "POST", "meaning": "フォームなどのデータを、相手のサーバーへ送るための通信方法です。この言葉だけで、情報漏えいや設定変更が起きたと判断するものではありません。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST", "kind": "general_definition" }, { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2019-9875", "aliases": [], "title": "n/a：コード実行", "summary": "Sitecore の anti‑CSRF モジュールにおける信頼できないデータの逆シリアル化により、認証済みの攻撃者が HTTP POST パラメータにシリアライズされた .NET オブジェクトを送信するだけで任意のコードを実行できる脆弱性が、9.1 以前のバージョンで存在します。", "risk": "攻撃者はサーバー上で任意のコードを実行させられます。", "product": "Sitecore CMS and Experience Platform (XP)", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-9875", "label": "CVE公式レコード" }, { "url": "https://dev.sitecore.net/Downloads.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/blog.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "label": "CVE掲載の参考情報" }, { "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9875", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2019-05-31T20:34:46.000Z", "modifiedAt": "2025-10-21T23:45:35.858Z", "fetchedAt": "2026-10-24T06:05:53.194Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2019-9875", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "fetchedAt": "2026-10-24T06:05:53.194Z", "publishedAt": "2019-05-31T20:34:46.000Z", "modifiedAt": "2025-10-21T23:45:35.858Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://dev.sitecore.net/Downloads.aspx", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.synacktiv.com/blog.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9875", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2019-9875:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "sourcePath": "retained:/originalText", "text": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2019-9875:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "modifiedAt": "2025-03-26T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:45:35.858Z", "fetchedAt": "2026-10-24T06:05:53.194Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-26T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T06:05:53.194Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "67045443df5a23d858dad5040b8d474a8489c32c24d709376b9c254035826902", "sourceModifiedAt": "2025-10-21T23:45:35.858Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Sitecore の anti‑CSRF モジュールにおける信頼できないデータの逆シリアル化により、認証済みの攻撃者が HTTP POST パラメータにシリアライズされた .NET オブジェクトを送信するだけで任意のコードを実行できる脆弱性が、9.1 以前のバージョンで存在します。", "risk": "攻撃者はサーバー上で任意のコードを実行させられます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "対象は Sitecore CMS および Experience Platform (XP) の anti‑CSRF モジュール (Sitecore.Security.AntiCSRF) で、攻撃者が認証済みであり、HTTP POST パラメータ __CSRFTOKEN にシリアライズされた .NET オブジェクトを送信できる環境です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Sitecore CMS and Experience Platform (XP)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-9875", "https://dev.sitecore.net/Downloads.aspx", "https://www.synacktiv.com/blog.html", "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556", "https://nvd.nist.gov/vuln/detail/CVE-2019-9875" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2019-9875", "https://dev.sitecore.net/Downloads.aspx", "https://www.synacktiv.com/blog.html", "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556", "https://nvd.nist.gov/vuln/detail/CVE-2019-9875" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-9875", "https://dev.sitecore.net/Downloads.aspx", "https://www.synacktiv.com/blog.html", "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556", "https://nvd.nist.gov/vuln/detail/CVE-2019-9875" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-9875", "label": "CVE公式レコード" }, { "url": "https://dev.sitecore.net/Downloads.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/blog.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "label": "CVE掲載の参考情報" }, { "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9875", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "sourceField": "retained:/originalText", "excerpt": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2019-9875\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2019-9875（Sitecore CMS and Experience Platform (XP)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は Sitecore CMS および Experience Platform (XP) の anti‑CSRF モジュール (Sitecore.Security.AntiCSRF) で、攻撃者が認証済みであり、HTTP POST パラメータ __CSRFTOKEN にシリアライズされた .NET オブジェクトを送信できる環境です。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2019-9875", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:05:53.194Z", "lastSuccess": "2026-10-24T06:05:53.194Z", "sourceCheckedAt": "2026-10-24T06:05:53.194Z", "errorCode": null }, "glossary": [ { "term": "CSRF", "meaning": "ログイン中の人のブラウザーを利用して、その人が意図しない操作をサイトへ送らせる問題です。本人の操作やログインが必要かは、個別の条件を確認します。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF", "kind": "general_definition" }, { "term": "POST", "meaning": "フォームなどのデータを、相手のサーバーへ送るための通信方法です。この言葉だけで、情報漏えいや設定変更が起きたと判断するものではありません。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST", "kind": "general_definition" }, { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-30154", "aliases": [], "title": "reviewdog：脆弱性情報", "summary": "reviewdog/action-setup@v1 が 2025 年 3 月 11 日 18:42〜20:31 UTC の間に改ざんされ、悪意のあるコードが追加されてシークレットが Github Actions のワークフローログに出力されました。また、reviewdog/action-setup@v1 を使用する reviewdog/action-shellcheck、reviewdog/action-composite-template、reviewdog/action-staticcheck、reviewdog/action-ast-grep、reviewdog/action-typos も同様に影響を受けます。", "risk": "悪意のあるコードにより、露出したシークレットが Github Actions のワークフローログに書き出されます。", "product": "reviewdog", "category": "other", "component": "package", "severity": "high", "cvss": 8.6, "cvssVersion": "3.1", "cvssSource": "GitHub_M", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "affected": [ { "product": "reviewdog", "range": "= 1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-30154", "label": "CVE公式レコード" }, { "url": "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "label": "CISAが示す関連情報" }, { "url": "https://github.com/reviewdog/reviewdog/issues/2079", "label": "https://github.com/reviewdog/reviewdog/issues/2079" }, { "url": "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "label": "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887" }, { "url": "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "label": "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec" }, { "url": "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "label": "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup" }, { "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30154", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-19T15:15:29.113Z", "modifiedAt": "2026-02-26T19:09:21.840Z", "fetchedAt": "2026-10-24T04:53:13.677Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.", "sourceTitle": "Multiple Reviewdog actions were compromised during a specific time period", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "reviewdog", "product": "reviewdog", "versions": [ { "version": "= 1", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-30154", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "fetchedAt": "2026-10-24T04:53:13.677Z", "publishedAt": "2025-03-19T15:15:29.113Z", "modifiedAt": "2026-02-26T19:09:21.840Z", "state": "published", "provider": "GitHub_M", "title": "Multiple Reviewdog actions were compromised during a specific time period", "descriptions": [ { "lang": "en", "value": "reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "reviewdog", "product": "reviewdog", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "= 1", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-506", "lang": "en", "description": "CWE-506: Embedded Malicious Code", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH", "provider": "GitHub_M", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "label": "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "tags": [ "x_refsource_CONFIRM" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/reviewdog/reviewdog/issues/2079", "label": "https://github.com/reviewdog/reviewdog/issues/2079", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/1" }, { "url": "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "label": "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/2" }, { "url": "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "label": "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/3" }, { "url": "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "label": "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/4" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30154", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"reviewdog\",\"product\":\"reviewdog\",\"versions\":[{\"version\":\"= 1\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-506\",\"lang\":\"en\",\"description\":\"CWE-506: Embedded Malicious Code\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-30154:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "sourcePath": "retained:/originalText", "text": "reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-30154:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "modifiedAt": "2025-03-24T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T19:09:21.840Z", "fetchedAt": "2026-10-24T04:53:13.677Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-24T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "reviewdogに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:53:13.677Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "67ca75843c2d539537d630e0b0422ce263b82a66156d1540a6b269943763230c", "sourceModifiedAt": "2026-02-26T19:09:21.840Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "reviewdog/action-setup@v1 が 2025 年 3 月 11 日 18:42〜20:31 UTC の間に改ざんされ、悪意のあるコードが追加されてシークレットが Github Actions のワークフローログに出力されました。また、reviewdog/action-setup@v1 を使用する reviewdog/action-shellcheck、reviewdog/action-composite-template、reviewdog/action-staticcheck、reviewdog/action-ast-grep、reviewdog/action-typos も同様に影響を受けます。", "risk": "悪意のあるコードにより、露出したシークレットが Github Actions のワークフローログに書き出されます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "GitHub Actions のワークフローで reviewdog/action-setup@v1 が使用されている場合、当該バージョンが 2025 年 3 月 11 日 18:42〜20:31 UTC の間に改ざんされたことにより、シークレットがログに漏洩します。さらに、reviewdog/action-setup@v1 を参照する reviewdog の他のアクション（action-shellcheck、action-composite-template、action-staticcheck、action-ast-grep、action-typos）もバージョンやピン止め方法に関わらず同様に影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：reviewdog / reviewdog。影響ありとして記載：= 1。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json" ], "evidenceIds": [ "E4" ] }, { "text": "「reviewdog」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-30154", "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "https://github.com/reviewdog/reviewdog/issues/2079", "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "https://nvd.nist.gov/vuln/detail/CVE-2025-30154" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-30154", "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "https://github.com/reviewdog/reviewdog/issues/2079", "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "https://nvd.nist.gov/vuln/detail/CVE-2025-30154" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-30154", "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "https://github.com/reviewdog/reviewdog/issues/2079", "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "https://nvd.nist.gov/vuln/detail/CVE-2025-30154" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-30154", "label": "CVE公式レコード" }, { "url": "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "label": "CISAが示す関連情報" }, { "url": "https://github.com/reviewdog/reviewdog/issues/2079", "label": "https://github.com/reviewdog/reviewdog/issues/2079" }, { "url": "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "label": "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887" }, { "url": "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "label": "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec" }, { "url": "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "label": "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup" }, { "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30154", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourceField": "/containers/cna/title", "excerpt": "Multiple Reviewdog actions were compromised during a specific time period", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "sourceField": "retained:/originalText", "excerpt": "reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"reviewdog\",\"product\":\"reviewdog\",\"versions\":[{\"version\":\"= 1\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-30154\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-30154（reviewdog）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・GitHub Actions のワークフローで reviewdog/action-setup@v1 が使用されている場合、当該バージョンが 2025 年 3 月 11 日 18:42〜20:31 UTC の間に改ざんされたことにより、シークレットがログに漏洩します。さらに、reviewdog/action-setup@v1 を参照する reviewdog の他のアクション（action-shellcheck、action-composite-template、action-staticcheck、action-ast-grep、action-typos）もバージョンやピン止め方法に関わらず同様に影響を受けます。\n・公式の対象表：reviewdog / reviewdog。影響ありとして記載：= 1。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-30154", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:53:13.677Z", "lastSuccess": "2026-10-24T04:53:13.677Z", "sourceCheckedAt": "2026-10-24T04:53:13.677Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2017-12637", "aliases": [], "title": "n/a：ファイルへの不正アクセス", "summary": "SAP NetWeaver Application Server Java の scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS にディレクトリトラバーサルの脆弱性があり、リモート攻撃者がクエリ文字列に \"..\" を入れることで任意のファイルを読み取れる。", "risk": "攻撃者が任意のファイルを取得できる。", "product": "SAP NetWeaver", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2017-12637", "label": "CVE公式レコード" }, { "url": "https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/", "label": "CVE掲載の参考情報" }, { "url": "https://me.sap.com/notes/3476549", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12637", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2017-08-07T20:00:00.000Z", "modifiedAt": "2025-10-21T23:55:35.932Z", "fetchedAt": "2026-10-24T06:06:39.071Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2017-12637", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "fetchedAt": "2026-10-24T06:06:39.071Z", "publishedAt": "2017-08-07T20:00:00.000Z", "modifiedAt": "2025-10-21T23:55:35.932Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12637", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.5,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2017-12637:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "sourcePath": "retained:/originalText", "text": "SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2017-12637:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "modifiedAt": "2025-03-19T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:55:35.932Z", "fetchedAt": "2026-10-24T06:06:39.071Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-19T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにファイルへの不正アクセスに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "許可していない場所のファイルにアクセスされる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T06:06:39.071Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f9bed483eded0f0933ca8638bf63a01329892fde389da2fa47642e5e3289e7f8", "sourceModifiedAt": "2025-10-21T23:55:35.932Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SAP NetWeaver Application Server Java の scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS にディレクトリトラバーサルの脆弱性があり、リモート攻撃者がクエリ文字列に \"..\" を入れることで任意のファイルを読み取れる。", "risk": "攻撃者が任意のファイルを取得できる。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "リモートから \"..\" を含むクエリ文字列を送信できることが必要。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json" ], "evidenceIds": [ "E2" ] }, { "text": "「SAP NetWeaver」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2017-12637", "https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "https://me.sap.com/notes/3476549", "https://nvd.nist.gov/vuln/detail/CVE-2017-12637" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2017-12637", "https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "https://me.sap.com/notes/3476549", "https://nvd.nist.gov/vuln/detail/CVE-2017-12637" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2017-12637", "https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "https://me.sap.com/notes/3476549", "https://nvd.nist.gov/vuln/detail/CVE-2017-12637" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2017-12637", "label": "CVE公式レコード" }, { "url": "https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/", "label": "CVE掲載の参考情報" }, { "url": "https://me.sap.com/notes/3476549", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12637", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2017-12637\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2017-12637（SAP NetWeaver）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートから \"..\" を含むクエリ文字列を送信できることが必要。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2017-12637", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:06:39.071Z", "lastSuccess": "2026-10-24T06:06:39.071Z", "sourceCheckedAt": "2026-10-24T06:06:39.071Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-48248", "aliases": [], "title": "Backup & Replication Director：コード実行", "summary": "NAKIVO Backup & Replication のバージョン 11.0.0.88174 未満では、getImageByPath を介して /c/router へ絶対パスでファイルを読み取ることができ、PhysicalDiscovery が平文の認証情報を保持しているため、企業全体でリモートコード実行が可能になる恐れがあります。", "risk": "企業全体でリモートコード実行が可能になる恐れがある。", "product": "Backup & Replication Director", "category": "other", "component": "package", "severity": "high", "cvss": 8.6, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "affected": [ { "product": "Backup & Replication Director", "range": "< 11.0.0.88174" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-48248", "label": "CVE公式レコード" }, { "url": "https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/", "label": "CVE掲載の参考情報" }, { "url": "https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48248", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-04T00:00:00.000Z", "modifiedAt": "2025-10-21T22:55:28.559Z", "fetchedAt": "2026-10-24T04:53:15.427Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Backup & Replication Director", "vendor": "NAKIVO", "versions": [ { "lessThan": "11.0.0.88174", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-48248", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "fetchedAt": "2026-10-24T04:53:15.427Z", "publishedAt": "2025-03-04T00:00:00.000Z", "modifiedAt": "2025-10-21T22:55:28.559Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "NAKIVO", "product": "Backup & Replication Director", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "11.0.0.88174", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-36", "lang": "en", "description": "CWE-36 Absolute Path Traversal", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/?ref=labs.watchtowr.com", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-48248", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Backup & Replication Director\",\"vendor\":\"NAKIVO\",\"versions\":[{\"lessThan\":\"11.0.0.88174\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-36\",\"description\":\"CWE-36 Absolute Path Traversal\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-48248:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "sourcePath": "retained:/originalText", "text": "NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-48248:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "modifiedAt": "2025-03-19T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T22:55:28.559Z", "fetchedAt": "2026-10-24T04:53:15.427Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-19T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Backup & Replication Directorにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:53:15.427Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b3a23dc1de2d0618d3a19dbd082efd1d2b62943cd97ddbf70f99441347030460", "sourceModifiedAt": "2025-10-21T22:55:28.559Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "NAKIVO Backup & Replication のバージョン 11.0.0.88174 未満では、getImageByPath を介して /c/router へ絶対パスでファイルを読み取ることができ、PhysicalDiscovery が平文の認証情報を保持しているため、企業全体でリモートコード実行が可能になる恐れがあります。", "risk": "企業全体でリモートコード実行が可能になる恐れがある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者が getImageByPath 機能を利用し、/c/router など任意のパスを指定してファイルを読み取れる環境で、PhysicalDiscovery が平文の認証情報を保持している場合に成立する。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：NAKIVO / Backup & Replication Director。影響ありとして記載：11.0.0.88174未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Backup & Replication Director」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-48248", "https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/", "https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "https://nvd.nist.gov/vuln/detail/CVE-2024-48248" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-48248", "https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/", "https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "https://nvd.nist.gov/vuln/detail/CVE-2024-48248" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-48248", "https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/", "https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "https://nvd.nist.gov/vuln/detail/CVE-2024-48248" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-48248", "label": "CVE公式レコード" }, { "url": "https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/", "label": "CVE掲載の参考情報" }, { "url": "https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48248", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Backup & Replication Director\",\"vendor\":\"NAKIVO\",\"versions\":[{\"lessThan\":\"11.0.0.88174\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-48248\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-48248（Backup & Replication Director）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者が getImageByPath 機能を利用し、/c/router など任意のパスを指定してファイルを読み取れる環境で、PhysicalDiscovery が平文の認証情報を保持している場合に成立する。\n・公式の対象表：NAKIVO / Backup & Replication Director。影響ありとして記載：11.0.0.88174未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-48248", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:53:15.427Z", "lastSuccess": "2026-10-24T04:53:15.427Z", "sourceCheckedAt": "2026-10-24T04:53:15.427Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-1316", "aliases": [], "title": "IC-7100 IP Camera：コード実行", "summary": "Edimax IC-7100 はリクエストを適切に無害化できません。攻撃者は細工したリクエストを作成し、デバイス上でリモートコード実行を行わせることができます。", "risk": "この脆弱性が悪用されると、攻撃者はデバイス上で任意のコードを実行できるようになります。", "product": "IC-7100 IP Camera", "category": "other", "component": "package", "severity": "critical", "cvss": 9.3, "cvssVersion": "4.0", "cvssSource": "icscert", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "affected": [ { "product": "IC-7100 IP Camera", "range": "All" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "label": "CVE：icscert" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "label": "CVE掲載の参考情報" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1316", "label": "CVE公式レコード" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1316", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-04T23:36:59.724Z", "modifiedAt": "2025-10-21T22:55:25.794Z", "fetchedAt": "2026-10-24T04:53:18.637Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device", "sourceTitle": "Edimax IC-7100 IP Camera OS Command Injection", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "IC-7100 IP Camera", "vendor": "Edimax", "versions": [ { "status": "affected", "version": "All" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-1316", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "fetchedAt": "2026-10-24T04:53:18.637Z", "publishedAt": "2025-03-04T23:36:59.724Z", "modifiedAt": "2025-10-21T22:55:25.794Z", "state": "published", "provider": "icscert", "title": "Edimax IC-7100 IP Camera OS Command Injection", "descriptions": [ { "lang": "en", "value": "Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Edimax", "product": "IC-7100 IP Camera", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "All", "status": "affected" } ] } ], "solutions": [], "workarounds": [ { "lang": "en", "value": "Edimax has not responded to CISA requests to coordinate the vulnerability. Affected users are encouraged to reach out to Edimax customer support https://www.edimax.com/edimax/form/contact_us/data/edimax/global/contact_us/ .", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 9.3, "baseSeverity": "CRITICAL", "provider": "icscert", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" }, { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "icscert", "sourcePath": "/containers/cna/metrics/1/cvssV3_1" } ], "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "label": "icscert", "tags": [], "provider": "icscert", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-1316", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"IC-7100 IP Camera\",\"vendor\":\"Edimax\",\"versions\":[{\"status\":\"affected\",\"version\":\"All\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "Edimax has not responded to CISA requests to coordinate the vulnerability. Affected users are encouraged to reach out to Edimax customer support https://www.edimax.com/edimax/form/contact_us/data/edimax/global/contact_us/ .", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-78\",\"description\":\"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"attackVector\":\"NETWORK\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"HIGH\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/1/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourcePath": "/containers/cna/metrics/1/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-1316:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "sourcePath": "retained:/originalText", "text": "Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-1316:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "linked:https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "sourcePath": "article:summary-vulnerabilities-remediations", "text": "Edimax IC-7100 IP Camera | CISA\n\n1. EXECUTIVE SUMMARY\n\nCVSS v4 9.3\n\nATTENTION : Exploitable remotely/low attack complexity/public exploits are available\n\nVendor : Edimax\n\nEquipment : IC-7100 IP Camera\n\nVulnerability : Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\n\n2. RISK EVALUATION\n\nSuccessful exploitation of this vulnerability could allow an attacker to send specially crafted requests to achieve remote code execution on the device.\n\n3. TECHNICAL DETAILS\n\n3.1 AFFECTED PRODUCTS\n\nThe following versions of Edimax products are affected:\n\nIC-7100 IP Camera: All versions\n\n3.2 VULNERABILITY OVERVIEW\n\n3.2.1 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78\n\nEdimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device\n\nCVE-2025-1316 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ).\n\nA CVSS v4 score has also been calculated for  CVE-2025-1316 . A base score of 9.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N ).\n\n3.3 BACKGROUND\n\nCRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities Sector\n\nCOUNTRIES/AREAS DEPLOYED: Worldwide\n\nCOMPANY HEADQUARTERS LOCATION: Taiwan\n\n3.4 RESEARCHER\n\nAkamai SIRT reported this vulnerability to CISA.\n\n4. MITIGATIONS\n\nEdimax has not responded to CISA requests to coordinate the vulnerability. Affected users are encouraged to reach out to Edimax customer support .\n\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:\n\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet .\n\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.\n\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies .\n\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets .\n\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies .\n\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\n\n5. UPDATE HISTORY\n\nMarch 4, 2025: Initial Publication\n\nThis product is provided subject to this Notification and this Privacy & Use policy.\n\nTags\n\nSector :\nCommercial Facilities Sector\n\nTopics :\nIndustrial Control System Vulnerabilities ,\nIndustrial Control Systems", "truncated": false, "representation": "html_text_excerpt", "relatedCve": "CVE-2025-1316", "relatedCves": [ "CVE-2025-1316" ] } ], "limits": { "completeness": "official_record_with_linked_advisories", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。 当該CVEを本文中に明記した、直接参照された公的機関・開発元の告知を追加しています。複数製品・CVEを含む告知の対策は、その製品・CVEとの対応関係を維持してください。", "excludedLinkedSources": [] }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "modifiedAt": "2025-03-19T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true }, { "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "title": "Edimax IC-7100 IP Camera | CISA", "relatedCves": [ "CVE-2025-1316" ] } ], "relatedDocuments": [ { "type": "html", "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "title": "Edimax IC-7100 IP Camera | CISA", "relatedCves": [ "CVE-2025-1316" ], "truncated": false } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T22:55:25.794Z", "fetchedAt": "2026-10-24T04:53:18.637Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-19T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "IC-7100 IP Cameraにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:53:18.637Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ff763c19d5b02de4f8b265ed3cfbda2bc58591bb634cbdfc85bff8faff03e669", "sourceModifiedAt": "2025-10-21T22:55:25.794Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Edimax IC-7100 はリクエストを適切に無害化できません。攻撃者は細工したリクエストを作成し、デバイス上でリモートコード実行を行わせることができます。", "risk": "この脆弱性が悪用されると、攻撃者はデバイス上で任意のコードを実行できるようになります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "公式の対象表：Edimax / IC-7100 IP Camera。影響ありとして記載：All。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json" ], "evidenceIds": [ "E4" ] }, { "text": "「IC-7100 IP Camera」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-1316", "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/", "https://nvd.nist.gov/vuln/detail/CVE-2025-1316" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "Edimax は CISA の連絡に応答していません。影響を受けたユーザーは Edimax カスタマーサポートへ問い合わせることが推奨されています。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json" ], "evidenceIds": [ "E5" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-1316", "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/", "https://nvd.nist.gov/vuln/detail/CVE-2025-1316" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "label": "CVE：icscert" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "label": "CVE掲載の参考情報" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1316", "label": "CVE公式レコード" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1316", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourceField": "/containers/cna/title", "excerpt": "Edimax IC-7100 IP Camera OS Command Injection", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "Edimax IC-7100 IP Camera | CISA\n\n1. EXECUTIVE SUMMARY\n\nCVSS v4 9.3\n\nATTENTION : Exploitable remotely/low attack complexity/public exploits are available\n\nVendor : Edimax\n\nEquipment : IC-7100 IP Camera\n\nVulnerability : Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\n\n2. RISK EVALUATION\n\nSuccessful exploitation of this vulnerability could allow an attacker to send specially crafted requests to achieve remote code execution on the device.\n\n3. TECHNICAL DETAILS\n\n3.1 AFFECTED PRODUCTS\n\nThe following versions of Edimax products are affected:\n\nIC-7100 IP Camera: All versions\n\n3.2 VULNERABILITY OVERVIEW\n\n3.2.1 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78\n\nEdimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device\n\nCVE-2025-1316 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ).\n\nA CVSS v4 score has also been calculated for  CVE-2025-1316 . A base score of 9.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N ).\n\n3.3 BACKGROUND\n\nCRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities Sector\n\nCOUNTRIES/AREAS DEPLOYED: Worldwide\n\nCOMPANY HEADQUARTERS LOCATION: Taiwan\n\n3.4 RESEARCHER\n\nAkamai SIRT reported this vulnerability to CISA.\n\n4. MITIGATIONS\n\nEdimax has not responded to CISA requests to coordinate the vulnerability. Affected users are encouraged to reach out to Edimax customer support .\n\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:\n\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet .\n\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.\n\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies .\n\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets .\n\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies .\n\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\n\n5. UPDATE HISTORY\n\nMarch 4, 2025: Initial Publication\n\nThis product is provided subject to this Notification and this Privacy & Use policy.\n\nTags\n\nSector :\nCommercial Facilities Sector\n\nTopics :\nIndustrial Control System Vulnerabilities ,\nIndustrial Control Systems", "language": null, "representation": "html_text_excerpt" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"IC-7100 IP Camera\",\"vendor\":\"Edimax\",\"versions\":[{\"status\":\"affected\",\"version\":\"All\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "Edimax has not responded to CISA requests to coordinate the vulnerability. Affected users are encouraged to reach out to Edimax customer support https://www.edimax.com/edimax/form/contact_us/data/edimax/global/contact_us/ .", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-1316\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-1316（IC-7100 IP Camera）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Edimax / IC-7100 IP Camera。影響ありとして記載：All。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-1316", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:53:18.637Z", "lastSuccess": "2026-10-24T04:53:18.637Z", "sourceCheckedAt": "2026-10-24T04:53:18.637Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-24472", "aliases": [], "title": "FortiOS / FortiProxy：認証の回避", "summary": "FortiOS 7.0.0 から 7.0.16 および FortiProxy 7.2.0 から 7.2.12、7.0.0 から 7.0.19 のバージョンに影響する、認証バイパス（代替経路またはチャネル利用）脆弱性（CWE‑288）です。Security Fabric が有効化されている環境で、上流および下流デバイスのシリアル番号を事前に把握したリモートの未認証攻撃者が、細工した CSF プロキシリクエストを送信することで、下流デバイスのスーパ―管理者権限を取得できる可能性があります。", "risk": "この認証バイパスにより、リモート攻撃者が細工した CSF プロキシリクエストを使ってスーパ―管理者権限を取得できる可能性があります。", "product": "FortiOS / FortiProxy", "category": "other", "component": "package", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "fortinet", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C", "affected": [ { "product": "FortiOS", "range": ">= 7.0.0 / <= 7.0.16" }, { "product": "FortiProxy", "range": ">= 7.2.0 / <= 7.2.12" }, { "product": "FortiProxy", "range": ">= 7.0.0 / <= 7.0.19" } ], "fixed": [], "steps": [ "FortiOS をバージョン 7.0.17 以上にアップグレードする。FortiProxy をバージョン 7.2.13 以上、または 7.0.20 以上にアップグレードする。", "「CVE-2025-24472」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24472", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24472", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-02-11T16:50:42.207Z", "modifiedAt": "2026-08-05T03:56:00.893Z", "fetchedAt": "2026-10-24T04:53:21.610Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Fortinet", "product": "FortiOS", "cpes": [ "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.16", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiProxy", "cpes": [ "cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.12", "status": "affected" }, { "versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.19", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-24472", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "fetchedAt": "2026-10-24T04:53:21.610Z", "publishedAt": "2025-02-11T16:50:42.207Z", "modifiedAt": "2026-08-05T03:56:00.893Z", "state": "published", "provider": "fortinet", "title": "", "descriptions": [ { "lang": "en", "value": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Fortinet", "product": "FortiOS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "7.0.0", "lessThanOrEqual": "7.0.16", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiProxy", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "7.2.0", "lessThanOrEqual": "7.2.12", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "7.0.0", "lessThanOrEqual": "7.0.19", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Upgrade to FortiOS version 7.0.17 or above\nUpgrade to FortiProxy version 7.2.13 or above\nUpgrade to FortiProxy version 7.0.20 or above", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-288", "lang": "en", "description": "Execute unauthorized code or commands", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "fortinet", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "label": "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "tags": [], "provider": "fortinet", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24472", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS\",\"cpes\":[\"cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.16\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiProxy\",\"cpes\":[\"cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.12\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.19\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Upgrade to FortiOS version 7.0.17 or above\nUpgrade to FortiProxy version 7.2.13 or above\nUpgrade to FortiProxy version 7.0.20 or above", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-288\",\"description\":\"Execute unauthorized code or commands\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-24472:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "sourcePath": "retained:/originalText", "text": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-24472:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "modifiedAt": "2025-03-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-05T03:56:00.893Z", "fetchedAt": "2026-10-24T04:53:21.610Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "FortiOS / FortiProxyに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:53:21.610Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a873d0867c9596879dca7fe09b182495d854a77a64abe9af2f85bb8a750c7127", "sourceModifiedAt": "2026-08-05T03:56:00.893Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "FortiOS 7.0.0 から 7.0.16 および FortiProxy 7.2.0 から 7.2.12、7.0.0 から 7.0.19 のバージョンに影響する、認証バイパス（代替経路またはチャネル利用）脆弱性（CWE‑288）です。Security Fabric が有効化されている環境で、上流および下流デバイスのシリアル番号を事前に把握したリモートの未認証攻撃者が、細工した CSF プロキシリクエストを送信することで、下流デバイスのスーパ―管理者権限を取得できる可能性があります。", "risk": "この認証バイパスにより、リモート攻撃者が細工した CSF プロキシリクエストを使ってスーパ―管理者権限を取得できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "リモートの未認証攻撃者が、上流および下流デバイスのシリアル番号を事前に把握し、Security Fabric が有効化されている環境で、細工した CSF プロキシリクエストを送信できることが条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Fortinet / FortiOS。影響ありとして記載：7.0.0以上、7.0.16以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Fortinet / FortiProxy。影響ありとして記載：7.2.0以上、7.2.12以下。影響ありとして記載：7.0.0以上、7.0.19以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json" ], "evidenceIds": [ "E3" ] }, { "text": "「FortiOS / FortiProxy」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-24472", "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "https://nvd.nist.gov/vuln/detail/CVE-2025-24472" ] } ], "actions": [ { "text": "FortiOS をバージョン 7.0.17 以上にアップグレードする。FortiProxy をバージョン 7.2.13 以上、または 7.0.20 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json" ], "evidenceIds": [ "E5" ] }, { "text": "「CVE-2025-24472」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-24472", "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "https://nvd.nist.gov/vuln/detail/CVE-2025-24472" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-24472", "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "https://nvd.nist.gov/vuln/detail/CVE-2025-24472" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-24472", "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "https://nvd.nist.gov/vuln/detail/CVE-2025-24472" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-24472", "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "https://nvd.nist.gov/vuln/detail/CVE-2025-24472" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24472", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24472", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "sourceField": "retained:/originalText", "excerpt": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS\",\"cpes\":[\"cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.16\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiProxy\",\"cpes\":[\"cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.12\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.19\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Upgrade to FortiOS version 7.0.17 or above\nUpgrade to FortiProxy version 7.2.13 or above\nUpgrade to FortiProxy version 7.0.20 or above", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-24472\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-24472（FortiOS / FortiProxy）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートの未認証攻撃者が、上流および下流デバイスのシリアル番号を事前に把握し、Security Fabric が有効化されている環境で、細工した CSF プロキシリクエストを送信できることが条件です。\n・公式の対象表：Fortinet / FortiOS。影響ありとして記載：7.0.0以上、7.0.16以下。\n・公式の対象表：Fortinet / FortiProxy。影響ありとして記載：7.2.0以上、7.2.12以下。影響ありとして記載：7.0.0以上、7.0.19以下。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-24472", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:53:21.610Z", "lastSuccess": "2026-10-24T04:53:21.610Z", "sourceCheckedAt": "2026-10-24T04:53:21.610Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-30066", "aliases": [], "title": "changed-files：脆弱性情報", "summary": "tj-actions の changed-files バージョン 46 未満では、リモートの攻撃者がアクションのログを読み取ることでシークレットを発見できる脆弱性があります。タグ v1 から v45.0.7 までが 2025‑03‑14 と 2025‑03‑15 に脅威アクターによりコミット 0e58ed8（悪意ある updateFeatures コードを含む）を指すよう改ざんされたため影響を受けました。", "risk": "リモートの攻撃者が GitHub Actions のワークフローログを読み取ることで、AWS のアクセスキーや GitHub の個人アクセストークン、npm トークン、プライベート RSA 鍵などの機密情報を取得できる可能性があります。", "product": "changed-files", "category": "other", "component": "package", "severity": "high", "cvss": 8.6, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "affected": [ { "product": "changed-files", "range": ">= 1 / < 46" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-30066", "label": "CVE公式レコード" }, { "url": "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/tj-actions/changed-files/issues/2463", "label": "CVE掲載の参考情報" }, { "url": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "label": "CVE掲載の参考情報" }, { "url": "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=43368870", "label": "CVE掲載の参考情報" }, { "url": "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=43367987", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/rackerlabs/genestack/pull/903", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/chains-project/maven-lockfile/pull/1111", "label": "CVE掲載の参考情報" }, { "url": "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "label": "CISAが示す関連情報" }, { "url": "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30066", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-15T00:00:00.000Z", "modifiedAt": "2026-02-26T19:09:29.628Z", "fetchedAt": "2026-10-24T04:55:52.951Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "changed-files", "vendor": "tj-actions", "versions": [ { "lessThan": "46", "status": "affected", "version": "1", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-30066", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "fetchedAt": "2026-10-24T04:55:52.951Z", "publishedAt": "2025-03-15T00:00:00.000Z", "modifiedAt": "2026-02-26T19:09:29.628Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "tj-actions", "product": "changed-files", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "1", "lessThan": "46", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-506", "lang": "en", "description": "CWE-506 Embedded Malicious Code", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/tj-actions/changed-files/issues/2463", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/2" }, { "url": "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/3" }, { "url": "https://news.ycombinator.com/item?id=43368870", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/4" }, { "url": "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/5" }, { "url": "https://news.ycombinator.com/item?id=43367987", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/6" }, { "url": "https://github.com/rackerlabs/genestack/pull/903", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/7" }, { "url": "https://github.com/chains-project/maven-lockfile/pull/1111", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/8" }, { "url": "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/9" }, { "url": "https://github.com/espressif/arduino-esp32/issues/11127", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/10" }, { "url": "https://github.com/modal-labs/modal-examples/issues/1100", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/11" }, { "url": "https://github.com/tj-actions/changed-files/issues/2464", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/12" }, { "url": "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/13" }, { "url": "https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/14" }, { "url": "https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/15" }, { "url": "https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/16" }, { "url": "https://github.com/tj-actions/changed-files/issues/2477", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/17" }, { "url": "https://blog.gitguardian.com/compromised-tj-actions/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/18" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"changed-files\",\"vendor\":\"tj-actions\",\"versions\":[{\"lessThan\":\"46\",\"status\":\"affected\",\"version\":\"1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-506\",\"description\":\"CWE-506 Embedded Malicious Code\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-30066:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "sourcePath": "retained:/originalText", "text": "tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-30066:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "modifiedAt": "2025-03-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T19:09:29.628Z", "fetchedAt": "2026-10-24T04:55:52.951Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "changed-filesに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:55:52.951Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ce232813d1d93cffb79e059b1550440c8e402f10a700104d312bf9f9077f9f4d", "sourceModifiedAt": "2026-02-26T19:09:29.628Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "tj-actions の changed-files バージョン 46 未満では、リモートの攻撃者がアクションのログを読み取ることでシークレットを発見できる脆弱性があります。タグ v1 から v45.0.7 までが 2025‑03‑14 と 2025‑03‑15 に脅威アクターによりコミット 0e58ed8（悪意ある updateFeatures コードを含む）を指すよう改ざんされたため影響を受けました。", "risk": "リモートの攻撃者が GitHub Actions のワークフローログを読み取ることで、AWS のアクセスキーや GitHub の個人アクセストークン、npm トークン、プライベート RSA 鍵などの機密情報を取得できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "リモートの攻撃者が GitHub Actions のワークフローログを読み取ることができる場合に成立します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：tj-actions / changed-files。影響ありとして記載：1以上、46未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json" ], "evidenceIds": [ "E3" ] }, { "text": "「changed-files」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-30066", "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "https://github.com/tj-actions/changed-files/issues/2463", "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "https://news.ycombinator.com/item?id=43368870", "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "https://news.ycombinator.com/item?id=43367987", "https://github.com/rackerlabs/genestack/pull/903", "https://github.com/chains-project/maven-lockfile/pull/1111", "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "https://nvd.nist.gov/vuln/detail/CVE-2025-30066" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-30066", "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "https://github.com/tj-actions/changed-files/issues/2463", "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "https://news.ycombinator.com/item?id=43368870", "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "https://news.ycombinator.com/item?id=43367987", "https://github.com/rackerlabs/genestack/pull/903", "https://github.com/chains-project/maven-lockfile/pull/1111", "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "https://nvd.nist.gov/vuln/detail/CVE-2025-30066" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-30066", "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "https://github.com/tj-actions/changed-files/issues/2463", "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "https://news.ycombinator.com/item?id=43368870", "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "https://news.ycombinator.com/item?id=43367987", "https://github.com/rackerlabs/genestack/pull/903", "https://github.com/chains-project/maven-lockfile/pull/1111", "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "https://nvd.nist.gov/vuln/detail/CVE-2025-30066" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-30066", "label": "CVE公式レコード" }, { "url": "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/tj-actions/changed-files/issues/2463", "label": "CVE掲載の参考情報" }, { "url": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "label": "CVE掲載の参考情報" }, { "url": "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=43368870", "label": "CVE掲載の参考情報" }, { "url": "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=43367987", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/rackerlabs/genestack/pull/903", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/chains-project/maven-lockfile/pull/1111", "label": "CVE掲載の参考情報" }, { "url": "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "label": "CISAが示す関連情報" }, { "url": "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30066", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "sourceField": "retained:/originalText", "excerpt": "tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"changed-files\",\"vendor\":\"tj-actions\",\"versions\":[{\"lessThan\":\"46\",\"status\":\"affected\",\"version\":\"1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-30066\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-30066（changed-files）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートの攻撃者が GitHub Actions のワークフローログを読み取ることができる場合に成立します。\n・公式の対象表：tj-actions / changed-files。影響ありとして記載：1以上、46未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-30066", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:55:52.951Z", "lastSuccess": "2026-10-24T04:55:52.951Z", "sourceCheckedAt": "2026-10-24T04:55:52.951Z", "errorCode": null }, "glossary": [] } } ], "total": 2256, "limit": 20, "offset": 900, "filters": { "product": "all", "type": "all", "q": "", "page": 46 }, "pagination": { "page": 46, "pageSize": 20, "totalPages": 113 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-24T13:17:49.742Z", "lastAttempt": "2026-10-24T13:17:49.742Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "error", "lastSuccess": "2026-10-24T12:17:52.875Z", "lastAttempt": "2026-10-24T13:17:49.742Z", "error": "GitHub API HTTP 429; 次回の定期取得で再確認", "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-24T13:17:49.742Z", "lastAttempt": "2026-10-24T13:17:49.742Z", "error": null, "recordCount": 1756, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "partial", "lastSuccess": "2026-10-24T12:17:52.875Z", "lastAttempt": "2026-10-24T13:17:49.742Z", "error": "未確認のページ・期間は次回の定期取得で続きから反映します。", "recordCount": 16, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-24T12:02:52.875Z 〜 2026-10-24T13:17:49.742Z、全製品の変更 500/1237件まで確認、対象16件反映。", "cursor": { "start": "2026-10-24T12:02:52.875Z", "end": "2026-10-24T13:17:49.742Z", "kind": "modified", "index": 500 }, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "error", "lastSuccess": "2026-10-24T12:17:52.875Z", "lastAttempt": "2026-10-24T13:17:49.742Z", "error": "HTTP 404", "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }