What is the CVSS score of CVE-2025-5113?

CVE-2025-5113 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2025-5113?

Within 24 hours: Isolate affected Diviotec devices from production networks and document all deployments. Within 7 days: Implement network segmentation to restrict access to the web interface, enable enhanced monitoring for suspicious commands, and contact Diviotec for patch timelines. Within 30 days: Evaluate alternative solutions; if no patch is available, develop a migration or decommissioning plan.

CVE-2025-5113

EUVD-2025-16615 HIGH

Command Injection (CWE-77)

2025-06-02 research@onekey.com

Command Injection

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2025-16615

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

CVE Published

Jun 02, 2025 - 08:15 nvd

HIGH 8.6

DescriptionCVE.org

The Diviotec professional series exposes a web interface. One endpoint is vulnerable to arbitrary command injection and hardcoded passwords are used.

AnalysisAI

Critical vulnerability in Diviotec professional series devices that combines arbitrary command injection via a web interface endpoint with hardcoded credentials, allowing authenticated attackers to execute arbitrary commands with high impact on confidentiality, integrity, and availability. The CVSS 8.6 score reflects the severity of command injection paired with hardcoded passwords that eliminate authentication barriers. This vulnerability affects network-accessible professional series devices and represents an immediate risk in environments where these devices are deployed, particularly where adjacent network access is possible.

Technical ContextAI

The vulnerability resides in the Diviotec professional series web interface (CWE-77: Improper Neutralization of Special Elements used in a Command). The root cause is insufficient input validation on a web endpoint that passes user-supplied data unsanitized to a system command execution function, enabling OS command injection. The presence of hardcoded credentials further degrades security posture by enabling unauthenticated or low-privilege attackers to escalate to command execution. The web interface likely uses a backend service (possibly CGI/PHP or similar) that directly invokes shell commands without proper escaping or use of safer APIs like execve() with parameterized arguments. The combination of both flaws—command injection (CWE-77) and hardcoded passwords (CWE-798)—creates a cascading attack chain requiring minimal attacker sophistication.

RemediationAI

Immediate steps: (1) Apply vendor-supplied firmware patches (check Diviotec support portal for patched professional series firmware version); (2) Until patching is feasible, implement network segmentation to restrict adjacent network access to professional series devices via firewall rules limiting Layer 2/3 access; (3) Change or disable hardcoded credentials if a management interface allows credential updates (consult device documentation); (4) Monitor device logs for exploitation attempts targeting the vulnerable endpoint (search for command injection payloads in web logs); (5) If the vulnerable endpoint function can be disabled without operational impact, consider disabling it as a temporary mitigation. Vendor patch availability must be confirmed with Diviotec; if no patch is available within 90 days, escalate to device manufacturer and consider device replacement or retirement.