How to fix CVE-2025-64090?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Is Command Injection affected by CVE-2025-64090?

Organizations using This vulnerability face critical risk from CVE-2025-64090, a command injection vulnerability rated CVSS 10.0. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise.

CVE-2025-64090

CRITICAL

2026-01-09 [email protected]

10.0

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 09, 2026 - 10:15 nvd

CRITICAL 10.0

Description

This vulnerability allows authenticated attackers to execute commands via the hostname of the device.

Analysis

Command injection via the hostname field allowing authenticated code execution with maximum CVSS 10.0 and scope change.

Technical Context

The hostname configuration is passed to a system command without sanitization (CWE-77). The scope change and maximum CVSS suggest the attacker gains control beyond the vulnerable application.

Affected Products

See vendor advisory

Remediation

Apply vendor patches. Sanitize all input used in system commands.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.1

CVSS: +50

POC: 0

CVE-2025-64090 vulnerability details – vuln.today

Back

CVE-2025-64090

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2025-64090

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code