Skip to main content

Windows CVE-2025-34095

| EUVD-2025-21031 CRITICAL
OS Command Injection (CWE-78)
2025-07-10 disclosure@vulncheck.com
Windows Command Injection Microsoft
9.3
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None

Lifecycle Timeline

4
EUVD ID Assigned
Mar 16, 2026 - 06:52 euvd
EUVD-2025-21031
Analysis Generated
Mar 16, 2026 - 06:52 vuln.today
PoC Detected
Jul 15, 2025 - 13:14 vuln.today
Public exploit code
CVE Published
Jul 10, 2025 - 20:15 nvd
CRITICAL 9.3

DescriptionNVD

An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute() code, which is then persisted on disk and triggered via a subsequent GET request to examples/manage.lsp. This allows remote command execution on the underlying operating system, impacting both Windows and Unix-based deployments.

AnalysisAI

Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/save.lsp. Attackers can send crafted PUT requests with arbitrary Lua os.execute() code that is persisted on disk and executed, achieving remote code execution on the embedded web server.

Technical ContextAI

The examples/save.lsp endpoint accepts PUT requests that write Lua code to disk. The endpoint is unauthenticated and does not validate the content. An attacker can inject Lua code containing os.execute() calls that execute system commands. Because the code is persisted, the backdoor survives server restarts.

RemediationAI

Remove the examples/ directory from production Mako deployments. Disable the save.lsp endpoint. Restrict Mako Server access to trusted networks. Audit saved Lua files for injected code.

More from same product – last 7 days

CVE-2026-40412 CRITICAL
10.0 May 22

Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
CVE-2026-41104 CRITICAL
10.0 May 22

Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
CVE-2026-23652 CRITICAL
10.0 May 22

Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
CVE-2026-47280 CRITICAL
10.0 May 22

Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
CVE-2026-42901 CRITICAL
10.0 May 22

Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain

Share

CVE-2025-34095 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy