EUVD-2025-210479
GHSA-9c8c-8pw3-xm92
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege console access
-
DeliveryReach eventlog/agentEvent/list endpoint
-
ExploitInject NoSQL operators into query parameter
-
ExecutionAlter backend query logic
-
ImpactExfiltrate or tamper with event-log data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Query language parameterization
|
| Exploitation Conditions | Exploitation requires network access to the AhnLab EPP Management console and a valid authenticated session at low privilege (CVSS PR:L), plus the ability to reach the specific eventlog/agentEvent/list endpoint that processes agent event-log listing requests. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once authenticated the injection is straightforward. Limiting factors: the attacker must first possess or obtain valid console credentials (this is not an unauthenticated flaw), the console must be network-reachable from the attacker's position, and only the named build v1.0.14.32-6249 is confirmed affected - other versions are unverified due to placeholder CPE/version data. |
| Impact | The CVSS 3.1 base score is 8.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - network-reachable, low complexity, no user interaction, but requiring low-level authentication, which constrains the attacker set to those with valid (even limited) console access. Confidentiality and integrity impact are High while availability is unaffected, consistent with a data-layer injection rather than a service-crash bug. No EPSS probability was supplied, so automated-exploitation likelihood cannot be quantified from the input, and the vulnerability is not in CISA KEV, so active exploitation is unconfirmed. A GitHub repository named after the CVE indicates public exploit/PoC interest, raising practical risk above a purely theoretical High. The key limiting/missing signal is the placeholder CPE and 'n/a' version data, which prevents precise scoping - verify affected builds with AhnLab before deprioritizing. |
| Exploit ScenarioDerived | An attacker holding a low-privilege AhnLab EPP Management account (or who has obtained such credentials) sends a crafted request to the eventlog/agentEvent/list endpoint containing NoSQL operators in a parameter passed unsanitized into the backend query. By coercing the query logic they retrieve security event data for endpoints outside their authorized scope or alter query filters to exfiltrate or tamper with records. A public GitHub repository named for this CVE suggests exploit or PoC material may be available, lowering the effort required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 17, 2026
NoSQL injection in AhnLab EPP (Endpoint Protection Platform) Management v1.0.14.32-6249 allows an authenticated attacker to manipulate backend NoSQL queries through the eventlog/agentEvent/list endpoint, as the CVSS:3.1 vector (PR:L) indicates a low-privilege authenticated session is required. Successful exploitation yields high confidentiality and integrity impact (C:H/I:H), enabling extraction or tampering of security event-log data across the managed endpoint fleet. A public GitHub repository named for this CVE suggests exploit/PoC material may exist; it is not listed in CISA KEV and no EPSS score was provided.
RemediationAI
No vendor-released patch version is identified in the provided data, so at time of analysis apply compensating controls and confirm a fixed build directly with AhnLab via https://ahnlab.com. Restrict network reachability of the EPP Management console so the eventlog/agentEvent/list endpoint is accessible only from trusted management networks or via VPN, reducing the AV:N exposure at the cost of remote-admin convenience. Tighten and audit console account privileges since exploitation requires authenticated (PR:L) access - remove unnecessary low-privilege accounts and enforce strong, monitored credentials to shrink the eligible attacker set. If the deployment permits, place a WAF or reverse-proxy rule in front of the console to inspect and reject NoSQL operator syntax (e.g., '$'-prefixed operators or embedded JSON objects) in the agentEvent listing parameters, accepting the risk of false positives on legitimate structured queries. Monitor console access and event-log query patterns for anomalous or high-volume list requests, and track the vendor site and NVD record for a released fixed version to apply once published.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AhnLab EPP is a centralized endpoint protection management console that aggregates agent telemetry and security event logs, typically backed by a NoSQL document store. CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) is the root cause: the eventlog/agentEvent/list endpoint incorporates attacker-controlled input into a NoSQL query without proper neutralization, so query selectors or document operators can be injected to alter query logic. Because NoSQL query languages often accept structured objects rather than flat strings, injection can bypass filters, force always-true conditions, or coerce the database into returning or modifying records the caller should not access. The provided CPE is a placeholder (cpe:2.3:a:n/a:n/a:*) and does not enumerate exact affected products, so scope rests on the single named build in the description.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable endpoint with low complexity but requiring an authenticated low-privilege session (PR:L); NoSQL injection exposes and alters data (C:H/I:H) without affecting availability (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.
Executive ViewAI
AhnLab EPP Management v1.0.14.32-6249 allows low-privilege users to manipulate or erase security event logs across your managed endpoints, with publicly available exploit code already in circulation. This directly undermines your ability to detect security breaches, respond to incidents, and maintain compliance audit trails-creating blind spots in your endpoint security visibility. Organizations must immediately restrict access to this component before the vulnerability is widely exploited.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network and administrative access to the affected endpoint using network ACLs and least-privilege principles; implement input validation or Web Application Firewall rules to block NoSQL injection attack patterns; disable the vulnerable endpoint if not business-critical; monitor for and alert on suspicious queries to eventlog/agentEvent/list; enforce multi-factor authentication for administrative accounts accessing EPP management; maintain immutable security log backups to enable forensic investigation of tampering.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
NoSQL injection exploits databases that don't use traditional SQL syntax-like MongoDB, CouchDB, or Redis-by manipulating queries through unsanitized user input.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB