What is the CVSS score of CVE-2025-23049?

CVE-2025-23049 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L. EPSS exploitation probability: 0.6%.

Which versions of Meridian Technique Materialise OrthoView are affected by CVE-2025-23049?

Meridian Technique Materialise OrthoView versions through 7.5.1 contain a critical command injection vulnerability that allows attackers to execute arbitrary operating system commands when servlet…

How to fix or mitigate CVE-2025-23049?

Within 24 hours: Inventory all OrthoView deployments and identify which have servlet sharing enabled; disable servlet sharing feature immediately if business operations permit. Within 7 days: Implement network segmentation to restrict access to OrthoView instances and apply WAF rules to block malicious payloads; contact Meridian Technique for patch timelines and interim guidance. Within 30 days: Deploy vendor patch immediately upon availability; conduct forensic analysis for signs of exploitation and reset credentials for affected systems.

Meridian Technique Materialise OrthoView CVE-2025-23049

EUVD-2025-27703 HIGH

OS Command Injection (CWE-78)

2025-06-23 cve@mitre.org

Command Injection

8.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 22:10 euvd

EUVD-2025-27703

Analysis Generated

Mar 15, 2026 - 22:10 vuln.today

CVE Published

Jun 23, 2025 - 12:15 nvd

HIGH 8.4

DescriptionCVE.org

Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled.

AnalysisAI

CVE-2025-23049 is an OS Command Injection vulnerability in Meridian Technique Materialise OrthoView through version 7.5.1 that allows unauthenticated remote attackers to execute arbitrary operating system commands when servlet sharing is enabled. The vulnerability has a CVSS score of 8.4 (High) and affects healthcare/dental imaging software used by medical professionals. Attackers can achieve high confidentiality impact and high availability impact, making this a significant threat to healthcare organizations relying on OrthoView for patient imaging workflows.

Technical ContextAI

This vulnerability is rooted in CWE-78 (Improper Neutralization of Special Elements used in an OS Command - OS Command Injection), which occurs when user-supplied input is improperly sanitized before being passed to OS command execution functions. OrthoView's servlet-based architecture, when servlet sharing is enabled, fails to adequately validate and escape user input that reaches OS-level command execution pathways. The vulnerability exists in the shared servlet handling mechanism (likely a component processing HTTP requests), allowing attackers to inject shell metacharacters or commands that are then executed with the privileges of the application server process. Materialise OrthoView is an orthodontic/dental imaging software platform (CPE likely: cpe:2.3:a:materialize:orthoview:*:*:*:*:*:*:*:*), which typically runs on medical workstations or servers processing sensitive patient imaging data.

RemediationAI

patch: Upgrade OrthoView to version 7.5.2 or later (version number inferred from 'through 7.5.1' language; vendor advisory should confirm exact patched version); priority: IMMEDIATE configuration_mitigation: If immediate patching is not possible, disable servlet sharing if operationally feasible. This reduces the attack surface while patches are tested and deployed.; priority: HIGH network_mitigation: Implement network segmentation and access controls (firewall rules, VPN requirements) to restrict access to OrthoView systems to authenticated internal networks only, reducing exposure from unauthenticated remote attacks.; priority: HIGH monitoring: Deploy web application firewalls (WAF) or intrusion detection systems (IDS) to detect and block OS command injection patterns (shell metacharacters: ; | & $ ( ) [ ] { } < > \) in HTTP requests to OrthoView endpoints.; priority: MEDIUM vendor_advisory: Consult Meridian Technique/Materialise official security advisory and patch release notes at vendor's support portal for detailed remediation guidance and compatibility information.