CVE-2025-14500

IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IceWarp. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the X-File-Operation header. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27394.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.zerodayinitiative.com/advisories/ZDI-25-1072/

Configurations

No configuration.

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de inyección de comandos y ejecución remota de código (RCE) en IceWarp14 X-File-Operation. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de IceWarp. No se requiere autenticación para explotar esta vulnerabilidad.\n\nEl defecto específico existe en el manejo de la cabecera X-File-Operation. El problema se debe a la falta de validación adecuada de una cadena suministrada por el usuario antes de usarla para ejecutar una llamada al sistema. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de SYSTEM. Fue ZDI-CAN-27394.

Information

Published : 2025-12-23 22:15

Updated : 2026-10-19 22:10

NVD link : CVE-2025-14500

Mitre link : CVE-2025-14500

CVE.ORG link : CVE-2025-14500

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-14500", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14500", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-30T21:16:42.631303Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "zdi-disclosures@trendmicro.com", "affectedData": [{"vendor": "IceWarp", "product": "IceWarp", "versions": [{"status": "affected", "version": "14.2.0.5"}], "defaultStatus": "unknown"}]}], "published": "2025-12-23T22:15:51.400", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1072/", "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IceWarp. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the X-File-Operation header. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27394."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n de comandos y ejecuci\u00f3n remota de c\u00f3digo (RCE) en IceWarp14 X-File-Operation. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de IceWarp. No se requiere autenticaci\u00f3n para explotar esta vulnerabilidad.\\n\\nEl defecto espec\u00edfico existe en el manejo de la cabecera X-File-Operation. El problema se debe a la falta de validaci\u00f3n adecuada de una cadena suministrada por el usuario antes de usarla para ejecutar una llamada al sistema. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto de SYSTEM. Fue ZDI-CAN-27394."}], "lastModified": "2026-10-19T22:10:00.130", "sourceIdentifier": "zdi-disclosures@trendmicro.com"}