IceWarp CVE-2025-14500

Exploitation requires network reachability to the IceWarp service that processes the X-File-Operation header; the attacker crafts that header with an injected OS command string. No authentication is required (PR:N) and no user interaction is needed (UI:N), so default internet-facing deployments are exposed. The primary limiting factor is that the attacker must be able to reach the vulnerable HTTP endpoint - servers behind restrictive network segmentation, WAF rules filtering the X-File-Operation header, or not exposed to untrusted networks reduce realistic exposure. Specific affected versions were not provided in the input, so defenders should confirm their IceWarp build against the vendor/ZDI advisory.

All available technical signals point to this being a genuine high-priority vulnerability, not an inflated CVSS score. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with the stated outcome of arbitrary code execution as SYSTEM via OS command injection (CWE-78). The description's claim that authentication is not required corroborates the PR:N metric, so the signals are internally consistent. However, several real-world risk amplifiers are MISSING from the input and could not be confirmed: there is no EPSS score, no CISA KEV listing, and no indication of public POC/exploit code - so there is no public exploit identified at time of analysis. The only source is a single Zero Day Initiative advisory (ZDI-25-1072, ZDI-CAN-27394) reported by Trend Micro ZDI; no independent vendor advisory or NVD enrichment beyond the reference was provided. Net assessment: the vulnerability class and metrics make this a priority to patch, but current evidence indicates no confirmed active exploitation - treat as high-priority-but-not-yet-exploited pending vendor fix and KEV monitoring.

A remote, unauthenticated attacker sends a specially crafted HTTP request to an internet-facing IceWarp server containing a malicious X-File-Operation header. Because the user-supplied string is passed to a system call without proper validation, the injected command executes in the context of the SYSTEM account, giving full server compromise. Given AV:N and AC:L, the request can be delivered directly over the network with no user interaction; no public exploit code is identified at time of analysis.