{"id":"CVE-2025-2605","aliases":["EUVD-2025-13247","GHSA-4p7f-6rw5-m5v7"],"status":"published","title":"Authenticated command injection","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most recent version of this product.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.16004,"percentile":0.96932,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2025-05-02T12:39:39Z","modified":"2026-06-17T09:07:16Z","products":[{"vendor":"honeywell","product":"mb-secure"},{"vendor":"honeywell","product":"mb-secure_firmware"},{"vendor":"honeywell","product":"mb-secure_pro_firmware"}],"references":[{"url":"https://www.honeywell.com/us/en/product-security#security-notices","tags":["vendor-advisory","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/May/19"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2605"},{"url":"https://github.com/advisories/GHSA-4p7f-6rw5-m5v7"}],"sources":{"cve":[{"id":"CVE-2025-2605","title":"Authenticated command injection","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most recent version of this product.","status":"published","published":"2025-05-02T12:39:39.979Z","modified":"2025-05-17T06:03:36.347Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:38.351095Z"}],"euvd":[{"id":"EUVD-2025-13247","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most recent version of this product.","status":"published","published":"2025-05-02T12:39:39Z","modified":"2025-05-17T06:03:36Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:44.705403Z"}],"ghsa":[{"id":"GHSA-4p7f-6rw5-m5v7","title":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')...","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most recent version of this product.","status":"published","published":"2025-05-02T15:31:47Z","modified":"2025-05-17T06:31:28Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:02:20.443164Z"}],"nvd":[{"id":"CVE-2025-2605","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most recent version of this product.","status":"published","published":"2025-05-02T13:15:46.44Z","modified":"2026-06-17T09:07:16.293Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:11:04.33372Z"}]}}