What is the CVSS score of CVE-2025-69600?

CVE-2025-69600 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Raynet RayVentory are affected by CVE-2025-69600?

A critical privilege escalation flaw in Raynet RayVentory (versions through 12.6.4392.49) enables any authenticated local user to execute arbitrary commands with administrative privileges, converting…

How to fix or mitigate CVE-2025-69600?

Within 24 hours: Conduct inventory of all systems running RayVentory 12.6.4392.49 or earlier; restrict local system access to this application to trusted administrators only; document business justification and risk acceptance. Within 7 days: Contact Raynet support directly to confirm patch availability and release timeline; implement compensating controls to disable getconfig command and oracle -o flag where operationally feasible; isolate affected systems from standard user workstations via network segmentation. Within 30 days: Apply vendor patch to all affected systems immediately upon release; if Raynet provides no patch timeline or releases patch beyond 30 days, escalate to business leadership for risk acceptance or system replacement decision.

Raynet RayVentory CVE-2025-69600

HIGH

Command Injection (CWE-77)

2026-05-27 cve@mitre.org

Java Command Injection RCE Oracle

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 16:22 vuln.today

CVSS changed

May 28, 2026 - 16:22 NVD

7.8 (None) 7.8 (HIGH)

CVE Published

May 27, 2026 - 18:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Command injection in Raynet rvia 12.6.4392.49-amd64.deb allows adversaries to execute commands via getconfig, and upload through the URL argument, and oracle through the -o flag The Supplier's perspective is that this is caused by Argument Injection in the find command query in rvia 12.6.4392.49. This in an arbitrary code execution flaw caused by an incorrectly constructed find command. The application actively searches for a Java executable by using search criteria that is not properly terminated or sanitized. By constructing a crafted directory path that satisfies the malformed search criteria, an attacker can trick the application into executing arbitrary Java code. This differs from standard PATH manipulation because it stems from the application's internal search logic. Specifically, a local attacker can create a crafted directory structure and path that satisfies an improperly terminated find query used by the application to locate a Java runtime.

AnalysisAI

Local privilege escalation via command injection in Raynet rvia (RayVentory) 12.6.4392.49-amd64.deb allows authenticated local users to achieve arbitrary code execution by exploiting an improperly terminated find query the application uses to locate the Java runtime. The flaw is reachable through the getconfig command, the upload URL argument, and the oracle -o flag, and publicly available exploit code exists on GitHub although no active exploitation has been observed.

Technical ContextAI

The vulnerability resides in the rvia binary shipped in the Raynet RayVentory Debian package (version 12.6.4392.49-amd64.deb), an IT asset discovery and inventory agent. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command) - specifically argument injection into a find(1) invocation that the application uses internally to locate a Java executable. Because the search predicate is not properly terminated or sanitized, an attacker who controls a directory path on the filesystem can supply a crafted structure that the malformed find query treats as additional arguments, causing the application to execute attacker-supplied Java code. This is distinct from classic PATH hijacking because the trust boundary is inside the application's own discovery logic rather than the shell environment.

Affected ProductsAI

The vulnerability affects Raynet rvia (the RayVentory Linux agent) at version 12.6.4392.49, as distributed in the rvia 12.6.4392.49-amd64.deb package. No CPE strings were provided in the input, so coverage of other RayVentory components or platforms is not independently confirmed. The vendor advisory tracking this issue is RVY200865 at https://support.raynet.de/hc/en-us/articles/19518792826132-RVY200865-RayVentory-12-6.

RemediationAI

Consult the Raynet vendor advisory RVY200865 at https://support.raynet.de/hc/en-us/articles/19518792826132-RVY200865-RayVentory-12-6 for the fixed release; an exact patched version is not stated in the provided input data, so administrators should obtain the latest RayVentory 12.6 build directly from Raynet support and upgrade the rvia agent on all Linux hosts. As compensating controls until patched, restrict who can create directories on filesystem paths that rvia traverses during Java discovery (chmod/chown writable temp and scan roots to root-only), and where operationally tolerable run the rvia agent with reduced privileges or under a confined AppArmor/SELinux profile that denies execve of unexpected binaries - note this may break legitimate Oracle/Java inventory collection. Also audit recent invocations of rvia with the getconfig, upload (URL argument), and oracle (-o) entry points referenced in the public PoC at https://github.com/Wise-Security/CVE-2025-69600.