by Kastro
Paper/Archive/CVE-2025-27590

CVE-2025-27590

Oxidized Web project Oxidized Web — In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux…

EPSS 28%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.1.981 × 2019.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.

Affected

ProductAffectedFixed inSource
Oxidized Web< 0.15.00.15.0CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitre (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/ytti/oxidized-web/releases/tag/0.15.0refgithub.com/ytti/oxidized-web/commit/a5220a0ddc57b85cd122bffee228d3ed4901668e