EUVD-2025-210842
GHSA-h2f7-75mh-c4rv
Severity by source
AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Vendor-supplied vector is accurate: admin credentials required (PR:H), management network adjacency needed (AV:A), full host compromise with scope change (S:C/C:H/I:H/A:H).
Primary rating from Vendor (WSO2).
CVSS VectorVendor: WSO2
Lifecycle Timeline
3DescriptionCVE.org
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.
Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
AnalysisAI
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administrator with adjacent network access to execute arbitrary operating system commands, leading to complete compromise of the affected system. The vulnerability spans at least eight WSO2 middleware products - including API Manager, Identity Server, Open Banking components, Traffic Manager, Universal Gateway, and API Control Plane - all of which share the Carbon Console administrative layer. The CVSS scope-change flag (S:C) indicates that successful exploitation extends impact beyond the WSO2 application boundary to the underlying host and potentially adjacent systems.
Technical ContextAI
Carbon Console is WSO2's shared web-based administrative UI, built on the open-source WSO2 Carbon framework and bundled into virtually every WSO2 middleware product. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) identifies the root cause: one or more administrative operations pass user-supplied input to OS-level command execution without adequate sanitization or escaping. The adjacent attack vector (AV:A) aligns with Carbon Console's typical deployment on a management or internal network segment, not the public internet. Affected products span the full WSO2 ecosystem per CPE: wso2_api_manager, wso2_identity_server, wso2_identity_server_as_key_manager, wso2_open_banking_am, wso2_open_banking_iam, wso2_traffic_manager, wso2_universal_gateway, and wso2_api_control_plane. Exact vulnerable version ranges are not specified in the CPE data (wildcard versions).
RemediationAI
Consult the WSO2 security advisory at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/ for confirmed fixed versions across each affected product - exact patch version numbers are not independently confirmed from the available CPE data, which uses wildcard version ranges. As an immediate compensating control, restrict network access to Carbon Console management ports to trusted administrator IP ranges only, leveraging firewall or network ACL rules; this directly exploits the AV:A vector limitation and prevents unapproved adjacent-network actors from reaching the interface even with stolen credentials. Enforce multi-factor authentication on all Carbon Console administrative accounts to raise the bar for credential compromise. Audit administrative account usage for anomalous activity. Until patched, consider disabling specific administrative operations identified in the advisory as the injection vectors if WSO2 documents them.
More in Wso2 Api Manager
View allAuthentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making ser
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffi
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
WSO2 API Manager and API Control Plane use a non-cryptographic PRNG in the API Publisher component to generate shared se
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing opera
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today