by Kastro
Paper/Archive/CVE-2025-9588

CVE-2025-9588

Iron Mountain Archiving Services Inc. enVision — OS Command Injection in Iron Mountain's enVision

EPSS 1%CVSS 10.0
critical.is priorityof 100
43
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 65.7.657 × 2013.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection. This issue affects enVision: before 250563.

Affected

ProductAffectedFixed inSource
enVision< 250563250563CNA

Scores by source

TR-CERT (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refusom.gov.tr/bildirim/tr-25-0285refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0285