CVE-2025-61937

CRITICAL
2026-01-16 [email protected]
10.0
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 16, 2026 - 02:16 nvd
CRITICAL 10.0

Tags

RCE Process Optimization

Description

The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the  model application server.

Analysis

A CVSS 10.0 code injection vulnerability allows unauthenticated attackers to achieve remote code execution with OS-level system privileges on the affected product.

Technical Context

This CWE-94 code injection vulnerability allows unauthenticated network-based attackers to inject and execute arbitrary code that runs with operating system system-level privileges, providing complete control over the target.

Affected Products

['Affected product (details pending vendor disclosure)']

Remediation

Apply vendor patches immediately. If no patch is available, restrict network access to the vulnerable service and implement WAF rules.

Priority Score

50
Low Medium High Critical
KEV: 0
EPSS: +0.1
CVSS: +50
POC: 0

Share

CVE-2025-61937 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy