What is the CVSS score of CVE-2025-60357?

CVE-2025-60357 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of AhnLab EPP are affected by CVE-2025-60357?

AhnLab EPP Management v1.0.14.32-6249 allows low-privilege users to manipulate or erase security event logs across your managed endpoints, with publicly available exploit code already in circulation.

How to fix or mitigate CVE-2025-60357?

Within 24 hours: immediately identify and inventory all systems running AhnLab EPP Management v1.0.14.32-6249; restrict network access to the eventlog/agentEvent/list endpoint using firewall rules; audit recent access logs for suspicious activity. Within 7 days: monitor AhnLab security advisories for vendor patches and apply immediately upon release; implement network segmentation limiting EPP management interface access to authorized administrative networks only; review and strengthen access controls for low-privilege accounts. Within 30 days: evaluate migration to a patched AhnLab EPP version or alternative endpoint protection solutions; conduct forensic review of security event logs to identify evidence of tampering; document all mitigations implemented and their effectiveness.

AhnLab EPP CVE-2025-60357

EUVD-2025-210479 HIGH

Improper Neutralization of Special Elements in Data Query Logic (CWE-943)

2026-07-17 mitre

GHSA-9c8c-8pw3-xm92

Code Injection Nosql Injection N A

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable endpoint with low complexity but requiring an authenticated low-privilege session (PR:L); NoSQL injection exposes and alters data (C:H/I:H) without affecting availability (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 17:23 vuln.today

CVSS changed

Jul 17, 2026 - 17:22 NVD

8.1 (HIGH)

CVE Published

Jul 17, 2026 - 00:00 cve.org

HIGH 8.1

CVE Published

Jul 17, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.

AnalysisAI

NoSQL injection in AhnLab EPP (Endpoint Protection Platform) Management v1.0.14.32-6249 allows an authenticated attacker to manipulate backend NoSQL queries through the eventlog/agentEvent/list endpoint, as the CVSS:3.1 vector (PR:L) indicates a low-privilege authenticated session is required. Successful exploitation yields high confidentiality and integrity impact (C:H/I:H), enabling extraction or tampering of security event-log data across the managed endpoint fleet. A public GitHub repository named for this CVE suggests exploit/PoC material may exist; it is not listed in CISA KEV and no EPSS score was provided.

Technical ContextAI

AhnLab EPP is a centralized endpoint protection management console that aggregates agent telemetry and security event logs, typically backed by a NoSQL document store. CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) is the root cause: the eventlog/agentEvent/list endpoint incorporates attacker-controlled input into a NoSQL query without proper neutralization, so query selectors or document operators can be injected to alter query logic. Because NoSQL query languages often accept structured objects rather than flat strings, injection can bypass filters, force always-true conditions, or coerce the database into returning or modifying records the caller should not access. The provided CPE is a placeholder (cpe:2.3:a:n/a:n/a:*) and does not enumerate exact affected products, so scope rests on the single named build in the description.

RemediationAI

No vendor-released patch version is identified in the provided data, so at time of analysis apply compensating controls and confirm a fixed build directly with AhnLab via https://ahnlab.com. Restrict network reachability of the EPP Management console so the eventlog/agentEvent/list endpoint is accessible only from trusted management networks or via VPN, reducing the AV:N exposure at the cost of remote-admin convenience. Tighten and audit console account privileges since exploitation requires authenticated (PR:L) access - remove unnecessary low-privilege accounts and enforce strong, monitored credentials to shrink the eligible attacker set. If the deployment permits, place a WAF or reverse-proxy rule in front of the console to inspect and reject NoSQL operator syntax (e.g., '$'-prefixed operators or embedded JSON objects) in the agentEvent listing parameters, accepting the risk of false positives on legitimate structured queries. Monitor console access and event-log query patterns for anomalous or high-volume list requests, and track the vendor site and NVD record for a released fixed version to apply once published.