What is the CVSS score of CVE-2025-15349?

CVE-2025-15349 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Shockline are affected by CVE-2025-15349?

A remote code execution vulnerability affecting Anritsu ShockLine devices poses a significant risk to organizations using this network testing equipment.

How to fix or mitigate CVE-2025-15349?

Within 24 hours: Identify all Anritsu ShockLine devices in your environment and isolate them to a segmented network with restricted access. Within 7 days: Implement network access controls limiting connectivity to authorized personnel only, disable non-essential SCPI remote commands if possible, and establish enhanced monitoring for anomalous device behavior. Within 30 days: Contact Anritsu for patch availability status, evaluate replacing vulnerable devices if patches remain unavailable, and conduct a security assessment of any systems that communicated with affected ShockLine devices.

Shockline CVE-2025-15349

HIGH

Race Condition (CWE-362)

2026-01-23 zdi-disclosures@trendmicro.com

RCE Race Condition Shockline

7.5

CVSS 3.0

CVSS VectorNVD

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 04:16 nvd

HIGH 7.5

DescriptionNVD

Anritsu ShockLine SCPI Race Condition Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Anritsu ShockLine. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the SCPI component. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27315.

AnalysisAI

Technical ContextAI

Classified as CWE-362 (Race Condition). Affects the SCPI component of Shockline. Anritsu ShockLine SCPI Race Condition Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Anritsu ShockLine. Authentication is not required to exploit this vulnerability.

RemediationAI

Monitor vendor advisories for a patch.

CVE-2025-15349 vulnerability details – vuln.today

Back

Shockline CVE-2025-15349

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code