CVE-2025-3363 - Vulnerability Details - OpenCVE

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00462.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Hgiga	Isherlock

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Hgiga	Isherlock

Fixes

Solution

For iSherlock 4.5, please update package iSherlock-user-4.5 to version 236 or later. For iSherlock 5.5, please update package iSherlock-user-5.5 to version 236 or later.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.twcert.org.tw/en/cp-139-10056-c553a-2.html
https://www.twcert.org.tw/tw/cp-132-10054-84588-1.html

History

Tue, 08 Apr 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 08 Apr 2025 14:30:00 +0000

Type	Values Removed	Values Added
Title		HGiga iSherlock - OS Command Injection

Tue, 08 Apr 2025 02:45:00 +0000

Type	Values Removed	Values Added
Description		The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.
Weaknesses		CWE-78
References		https://www.twcert.org.tw/en/cp-139-10056-c553a-2.html https://www.twcert.org.tw/tw/cp-132-10054-84588-1.html
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2025-04-08T02:11:48.241Z

Updated: 2025-04-08T14:19:12.551Z

Reserved: 2025-04-07T03:20:18.727Z

Link: CVE-2025-3363

Vulnrichment

Updated: 2025-04-08T14:19:07.998Z

NVD

Status : Awaiting Analysis

Published: 2025-04-08T02:15:21.077

Modified: 2025-04-08T18:13:53.347

Link: CVE-2025-3363

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-06-24T09:44:20Z

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3363", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2025-04-07T03:20:18.727Z", "datePublished": "2025-04-08T02:11:48.241Z", "dateUpdated": "2025-04-08T14:19:12.551Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "iSherlock-user-4.5", "product": "iSherlock 4.5", "vendor": "HGiga", "versions": [{"lessThan": "236", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "iSherlock-user-5.5", "product": "iSherlock 5.5", "vendor": "HGiga", "versions": [{"lessThan": "236", "status": "affected", "version": "0", "versionType": "custom"}]}], "datePublic": "2025-04-08T02:04:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server."}], "value": "The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server."}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2025-04-08T02:11:48.241Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-10054-84588-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-10056-c553a-2.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "For iSherlock 4.5, please update package iSherlock-user-4.5 to version 236 or later.<br>For iSherlock 5.5, please update package iSherlock-user-5.5 to version 236 or later.<br>"}], "value": "For iSherlock 4.5, please update package iSherlock-user-4.5 to version 236 or later.\nFor iSherlock 5.5, please update package iSherlock-user-5.5 to version 236 or later."}], "source": {"advisory": "TVN-202504003", "discovery": "EXTERNAL"}, "title": "HGiga iSherlock - OS Command Injection", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-08T14:19:03.382065Z", "id": "CVE-2025-3363", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-08T14:19:12.551Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3363", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-08T14:19:03.382065Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-08T14:19:07.998Z"}}], "cna": {"title": "HGiga iSherlock - OS Command Injection", "source": {"advisory": "TVN-202504003", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "HGiga", "product": "iSherlock 4.5", "versions": [{"status": "affected", "version": "0", "lessThan": "236", "versionType": "custom"}], "packageName": "iSherlock-user-4.5", "defaultStatus": "unaffected"}, {"vendor": "HGiga", "product": "iSherlock 5.5", "versions": [{"status": "affected", "version": "0", "lessThan": "236", "versionType": "custom"}], "packageName": "iSherlock-user-5.5", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "For iSherlock 4.5, please update package iSherlock-user-4.5 to version 236 or later.\nFor iSherlock 5.5, please update package iSherlock-user-5.5 to version 236 or later.", "supportingMedia": [{"type": "text/html", "value": "For iSherlock 4.5, please update package iSherlock-user-4.5 to version 236 or later.<br>For iSherlock 5.5, please update package iSherlock-user-5.5 to version 236 or later.<br>", "base64": false}]}], "datePublic": "2025-04-08T02:04:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-10054-84588-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-10056-c553a-2.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.", "supportingMedia": [{"type": "text/html", "value": "The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2025-04-08T02:11:48.241Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3363", "state": "PUBLISHED", "dateUpdated": "2025-04-08T14:19:12.551Z", "dateReserved": "2025-04-07T03:20:18.727Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2025-04-08T02:11:48.241Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}