by Kastro
Paper/Archive/CVE-2025-11900

CVE-2025-11900

HGiga iSherlock 4.5 — HGiga｜iSherlock - OS Command Injection

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 77.9.779 × 2015.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

Affected

ProductAffectedFixed inSource
iSherlock 4.5< 774774CNA
iSherlock 4.5< 440440CNA
iSherlock 5.5< 774774CNA
iSherlock 5.5< 440440CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10440-dd55d-1.htmlwriteuptwcert.org.tw/en/cp-139-10441-00aaf-2.html