by Kastro
Paper/Archive/CVE-2025-7451

CVE-2025-7451

Hgiga iSherlock-maillog-4.5 — Hgiga｜iSherlock - OS Command Injection

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.8.728 × 2014.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. This vulnerability has already been exploited. Please update immediately.

Affected

ProductAffectedFixed inSource
iSherlock-maillog-4.5< 137137CNA
iSherlock-smtp-4.5< 732732CNA
iSherlock-maillog-5.5< 137137CNA
iSherlock-smtp-5.5< 732732CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10237-9e0f7-1.htmlwriteuptwcert.org.tw/en/cp-139-10238-f2bba-2.html