CVE-2025-6225

Kieback&Peter Neutrino-GLT product is used for building management. It's web component "SM70 PHWEB" is vulnerable to shell command injection via login form. The injected commands would execute with low privileges. The vulnerability has been fixed in version 9.40.02

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/01/CVE-2025-6225/

Configurations

No configuration.

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El producto Kieback&Peter Neutrino-GLT se utiliza para la gestión de edificios. Su componente web 'SM70 PHWEB' es vulnerable a la inyección de comandos de shell a través del formulario de inicio de sesión. Los comandos inyectados se ejecutarían con privilegios bajos. La vulnerabilidad ha sido corregida en la versión 9.40.02.

Information

Published : 2026-01-07 14:15

Updated : 2026-10-07 09:10

NVD link : CVE-2025-6225

Mitre link : CVE-2025-6225

CVE.ORG link : CVE-2025-6225

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-6225", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6225", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:12:25.758893Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "Kieback&Peter", "modules": ["SM70 PHWEB"], "product": "Neutrino-GLT", "versions": [{"status": "affected", "version": "0", "lessThan": "9.40.02", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-07T14:15:54.657", "references": [{"url": "https://cert.pl/en/posts/2026/01/CVE-2025-6225/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Kieback&Peter Neutrino-GLT product is used for building management. It's web component\u00a0\"SM70 PHWEB\" is vulnerable to shell command injection via login form. The injected commands would execute with low privileges. The vulnerability has been fixed in version 9.40.02"}, {"lang": "es", "value": "El producto Kieback&Peter Neutrino-GLT se utiliza para la gesti\u00f3n de edificios. Su componente web 'SM70 PHWEB' es vulnerable a la inyecci\u00f3n de comandos de shell a trav\u00e9s del formulario de inicio de sesi\u00f3n. Los comandos inyectados se ejecutar\u00edan con privilegios bajos. La vulnerabilidad ha sido corregida en la versi\u00f3n 9.40.02."}], "lastModified": "2026-10-07T09:10:00.160", "sourceIdentifier": "cvd@cert.pl"}