CVE-2025-9588

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection. This issue affects enVision: before 250563.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0285
https://www.usom.gov.tr/bildirim/tr-25-0285	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:ironmountain:envision:*:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de Neutralización Inadecuada de Elementos Especiales utilizados en un Comando de SO ('Inyección de Comandos de SO') en Iron Mountain Archiving Services Inc. EnVision permite la inyección de comandos. Este problema afecta a enVision: antes de 250563.

Information

Published : 2025-09-23 08:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-9588

Mitre link : CVE-2025-9588

CVE.ORG link : CVE-2025-9588

JSON object : View

Products Affected

ironmountain

envision

linux

linux_kernel

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-9588", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9588", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-23T19:20:35.290451Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "iletisim@usom.gov.tr", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "iletisim@usom.gov.tr", "affectedData": [{"vendor": "Iron Mountain Archiving Services Inc.", "product": "enVision", "versions": [{"status": "affected", "version": "0", "lessThan": "250563", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-23T08:15:39.160", "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0285", "source": "iletisim@usom.gov.tr"}, {"url": "https://www.usom.gov.tr/bildirim/tr-25-0285", "tags": ["Third Party Advisory"], "source": "iletisim@usom.gov.tr"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "iletisim@usom.gov.tr", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection.\n\nThis issue affects enVision: before 250563."}, {"lang": "es", "value": "Vulnerabilidad de Neutralizaci\u00f3n Inadecuada de Elementos Especiales utilizados en un Comando de SO ('Inyecci\u00f3n de Comandos de SO') en Iron Mountain Archiving Services Inc. EnVision permite la inyecci\u00f3n de comandos. Este problema afecta a enVision: antes de 250563."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ironmountain:envision:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "630F9843-05BC-471B-8DFC-83BC70EAC47F", "versionEndExcluding": "250563"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "iletisim@usom.gov.tr"}