CVE-2025-2819 - Vulnerability Details - OpenCVE

There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00021.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Fixes

Solution

Update Software to the current version of the corresponding Software.

Workaround

* Prevent unauthorized physical access to the device * Disable E-Service to prevent remote access

References

Link	Providers
https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0001.pdf

History

Wed, 26 Mar 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 26 Mar 2025 15:00:00 +0000

Type	Values Removed	Values Added
Description		There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user.
Title		Unrestricted Fileupload
Weaknesses		CWE-434
References		https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0001.pdf
Metrics		cvssV3_1 `{'score': 6.6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: bizerba

Published: 2025-03-26T14:49:38.291Z

Updated: 2025-03-26T15:17:46.739Z

Reserved: 2025-03-26T14:42:48.119Z

Link: CVE-2025-2819

Vulnrichment

Updated: 2025-03-26T15:17:42.564Z

NVD

Status : Awaiting Analysis

Published: 2025-03-26T15:16:21.970

Modified: 2025-03-27T16:45:27.850

Link: CVE-2025-2819

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-2819", "assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6", "state": "PUBLISHED", "assignerShortName": "bizerba", "dateReserved": "2025-03-26T14:42:48.119Z", "datePublished": "2025-03-26T14:49:38.291Z", "dateUpdated": "2025-03-26T15:17:46.739Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "GT-SoftControl", "vendor": "Bizerba SE & Co. KG", "versions": [{"lessThan": "6.0", "status": "affected", "version": "0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user.\n\n<br>"}], "value": "There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6", "shortName": "bizerba", "dateUpdated": "2025-03-26T14:49:38.291Z"}, "references": [{"url": "https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0001.pdf"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update Software to the current version of the corresponding Software.\n\n<br>"}], "value": "Update Software to the current version of the corresponding Software."}], "source": {"advisory": "BIZERBA-SA-2025-0001", "discovery": "UNKNOWN"}, "title": "Unrestricted Fileupload", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ul><li><span style=\"background-color: var(--wht);\">Prevent unauthorized physical access to the device</span></li><li>Disable E-Service to prevent remote access</li></ul>\n\n<br>"}], "value": "* Prevent unauthorized physical access to the device\n * Disable E-Service to prevent remote access"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-26T15:17:38.843313Z", "id": "CVE-2025-2819", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T15:17:46.739Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2819", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-26T15:17:38.843313Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T15:17:42.564Z"}}], "cna": {"title": "Unrestricted Fileupload", "source": {"advisory": "BIZERBA-SA-2025-0001", "discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Bizerba SE & Co. KG", "product": "GT-SoftControl", "versions": [{"status": "affected", "version": "0.0", "lessThan": "6.0", "versionType": "semver"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "Update Software to the current version of the corresponding Software.", "supportingMedia": [{"type": "text/html", "value": "Update Software to the current version of the corresponding Software.\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0001.pdf"}], "workarounds": [{"lang": "en", "value": "* Prevent unauthorized physical access to the device\n * Disable E-Service to prevent remote access", "supportingMedia": [{"type": "text/html", "value": "<ul><li><span style=\"background-color: var(--wht);\">Prevent unauthorized physical access to the device</span></li><li>Disable E-Service to prevent remote access</li></ul>\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user.", "supportingMedia": [{"type": "text/html", "value": "There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user.\n\n<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6", "shortName": "bizerba", "dateUpdated": "2025-03-26T14:49:38.291Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2819", "state": "PUBLISHED", "dateUpdated": "2025-03-26T15:17:46.739Z", "dateReserved": "2025-03-26T14:42:48.119Z", "assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6", "datePublished": "2025-03-26T14:49:38.291Z", "assignerShortName": "bizerba"}, "dataVersion": "5.1"}