ELOG CVE-2025-64348

Requires valid authentication credentials to the ELOG system (PR:L indicates low-privilege user access is sufficient). The vulnerability affects all authenticated users regardless of role due to missing authorization checks (CWE-862). For denial of service impact, exploitation requires only the ability to modify the configuration file through authenticated access in default configurations. For remote code execution escalation, the ELOG instance must be specifically configured with the '-x' command line flag enabling the execute facility, which is NOT the default deployment. Per the description, 'By default, ELOG is not configured to allow shell commands or self-registration,' meaning the highest-severity impact requires deliberate non-default configuration. Additionally, exploitation is limited to environments where ELOG self-registration is enabled or where attackers have obtained credentials through other means (credential stuffing, phishing, password reuse). Network accessibility (AV:N) and low attack complexity (AC:L) indicate no additional network or timing prerequisites beyond authenticated access.

Real-world risk varies dramatically based on deployment configuration. The CVSS 4.0 score of 7.1 with VA:H (high availability) and VI:L (low integrity) accurately represents default configurations where only denial of service is achievable. However, the '-x' flag transforms this into a critical remote code execution vulnerability-a risk not fully captured by the current CVSS rating which lacks environmental metrics for this condition. PR:L (low privileges required) indicates any authenticated user can exploit this, not just administrators. AC:L (low attack complexity) suggests straightforward exploitation once credentials are obtained. Absence from CISA KEV and no public POC references suggest this is not yet actively exploited in the wild, reducing immediate urgency compared to weaponized vulnerabilities. The authentication requirement significantly limits attack surface compared to unauthenticated vulnerabilities. Organizations using ELOG in scientific/research environments should prioritize patching if they allow broad user registration or use the execute facility. The CISA CSAF advisory reference indicates government awareness but not active exploitation confirmation. Missing EPSS score prevents quantitative exploitation probability assessment, but the combination of authentication requirement, non-default dangerous configuration, and niche product deployment likely results in low widespread exploitation probability despite moderate-to-high severity.

An attacker with valid authenticated credentials to an ELOG system identifies an installation running with the execute facility enabled via the '-x' command line flag. The attacker uses their authenticated session to modify the configuration file, injecting malicious shell commands into configuration parameters processed by the execute facility. Upon ELOG processing the modified configuration, the injected commands execute with the privileges of the ELOG process, granting the attacker remote code execution on the host system. In default configurations without the execute facility, the attacker instead corrupts the configuration file to render ELOG inoperable, causing denial of service to users depending on the logbook system for documentation and collaboration.