CVE-2025-59379

DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying SQL database via Blind SQL Injection through the user parameter in the login page. This allows an attacker to steal credentials, which may be cleartext, from existing users (and admins) and use them to authenticate to the application.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/PilotPatrickk/Published-CVEs/blob/main/CVE-2025-59379.md	Third Party Advisory
https://info.dwyeromega.com/brands	Product
https://isensix.com/guardian/	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:dwyeromega:isensix_advanced_remote_monitoring_system_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dwyeromega:isensix_advanced_remote_monitoring_system:-:*:*:*:*:*:*:*

History

04 Nov 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 permite a un atacante recuperar información sensible de la base de datos SQL subyacente mediante inyección SQL ciega a través del parámetro user en la página de inicio de sesión. Esto permite a un atacante robar credenciales, que pueden estar en texto claro, de usuarios existentes (y administradores) y usarlas para autenticarse en la aplicación.

Information

Published : 2026-01-06 16:15

Updated : 2026-11-04 22:10

NVD link : CVE-2025-59379

Mitre link : CVE-2025-59379

CVE.ORG link : CVE-2025-59379

JSON object : View

Products Affected

dwyeromega

isensix_advanced_remote_monitoring_system
isensix_advanced_remote_monitoring_system_firmware

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-59379", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59379", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T16:30:42.919760Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-01-06T16:15:51.377", "references": [{"url": "https://github.com/PilotPatrickk/Published-CVEs/blob/main/CVE-2025-59379.md", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://info.dwyeromega.com/brands", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://isensix.com/guardian/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying SQL database via Blind SQL Injection through the user parameter in the login page. This allows an attacker to steal credentials, which may be cleartext, from existing users (and admins) and use them to authenticate to the application."}, {"lang": "es", "value": "DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 permite a un atacante recuperar informaci\u00f3n sensible de la base de datos SQL subyacente mediante inyecci\u00f3n SQL ciega a trav\u00e9s del par\u00e1metro user en la p\u00e1gina de inicio de sesi\u00f3n. Esto permite a un atacante robar credenciales, que pueden estar en texto claro, de usuarios existentes (y administradores) y usarlas para autenticarse en la aplicaci\u00f3n."}], "lastModified": "2026-11-04T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dwyeromega:isensix_advanced_remote_monitoring_system_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F1DAF0D-2D05-4692-B5E1-303D9DF6E96D", "versionEndIncluding": "1.5.7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dwyeromega:isensix_advanced_remote_monitoring_system:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "71213DB0-0D78-403E-BE7D-784F86B28568"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}