CVE-2025-9494

An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices.

CVSS

No CVSS.

References

Link	Resource
https://www.corporate.carrier.com/product-security/advisories-resources/

Configurations

No configuration.

History

11 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de inyección de comandos del sistema operativo (OS) ha sido descubierta en el Vitogate 300, que puede ser explotada por usuarios maliciosos para comprometer las instalaciones afectadas. Específicamente, el endpoint '/cgi-bin/vitogate.cgi' se ve afectado cuando el parámetro JSON 'form' se establece en 'form-0-2'. La vulnerabilidad se deriva del hecho de que esa función en el offset 0x21c24 no sanitiza adecuadamente la entrada proporcionada antes de interpolarla en una cadena de formato que se pasa a 'popen()'. En consecuencia, un atacante autenticado es capaz de inyectar comandos del sistema operativo (OS) arbitrarios y así obtener ejecución de código en los dispositivos afectados.

Information

Published : 2025-09-23 02:15

Updated : 2026-10-11 20:10

NVD link : CVE-2025-9494

Mitre link : CVE-2025-9494

CVE.ORG link : CVE-2025-9494

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-9494", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9494", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-23T13:33:59.911370Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "productsecurity@carrier.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "productsecurity@carrier.com", "affectedData": [{"vendor": "Viessmann", "product": "Vitogate 300", "versions": [{"status": "affected", "version": "1", "lessThan": "3.1.0.0", "versionType": "SKU"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-23T02:15:47.410", "references": [{"url": "https://www.corporate.carrier.com/product-security/advisories-resources/", "source": "productsecurity@carrier.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "productsecurity@carrier.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo (OS) ha sido descubierta en el Vitogate 300, que puede ser explotada por usuarios maliciosos para comprometer las instalaciones afectadas. Espec\u00edficamente, el endpoint '/cgi-bin/vitogate.cgi' se ve afectado cuando el par\u00e1metro JSON 'form' se establece en 'form-0-2'. La vulnerabilidad se deriva del hecho de que esa funci\u00f3n en el offset 0x21c24 no sanitiza adecuadamente la entrada proporcionada antes de interpolarla en una cadena de formato que se pasa a 'popen()'. En consecuencia, un atacante autenticado es capaz de inyectar comandos del sistema operativo (OS) arbitrarios y as\u00ed obtener ejecuci\u00f3n de c\u00f3digo en los dispositivos afectados."}], "lastModified": "2026-10-11T20:10:00.200", "sourceIdentifier": "productsecurity@carrier.com"}