What is the CVSS score of CVE-2025-3499?

CVE-2025-3499 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2025-3499?

Within 24 hours: Identify and inventory all affected devices exposing ports 8084/8086 on management networks; restrict network access to these ports via firewall rules to authorized personnel only. Within 7 days: Apply vendor-released patch to all identified devices and verify successful application. Within 30 days: Conduct full audit of management network segmentation, implement network access controls (jump hosts, VPN requirements), and deploy monitoring for suspicious API activity on these ports.

CVE-2025-3499

EUVD-2025-20794 CRITICAL

OS Command Injection (CWE-78)

2025-07-09 a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

Command Injection

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:51 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.02-1

EUVD ID Assigned

Mar 16, 2026 - 06:20 euvd

EUVD-2025-20794

Analysis Generated

Mar 16, 2026 - 06:20 vuln.today

CVE Published

Jul 09, 2025 - 09:15 nvd

CRITICAL 10.0

DescriptionCVE.org

The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary commands that are executed with administrative permissions by the underlying operating system.

Analysis

Technical ContextAI

Command injection allows an attacker to execute arbitrary OS commands on the host system through a vulnerable application that passes user input to system shells. This vulnerability is classified as OS Command Injection (CWE-78).

RemediationAI

Avoid passing user input to system commands. Use language-specific APIs instead of shell commands. If unavoidable, use strict input validation and escaping.