{"id":"CVE-2025-56814","aliases":["DEBIAN-CVE-2025-56814","EUVD-2025-210154","GHSA-wvcq-xvv7-c8m8","UBUNTU-CVE-2025-56814"],"status":"published","title":"A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to...","description":"A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00165,"percentile":0.05834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2026-06-15T00:00:00Z","modified":"2026-10-17T12:57:09Z","affected":[{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"opencpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"opencpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.4+dfsg-1","5.6.0+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"opencpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.4+dfsg-1","5.8.4+dfsg-1build3","5.8.4+dfsg-1build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"opencpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.10.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"opencpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.12.4+dfsg-1","1:5.14.1+dfsg-3","1:5.14.1+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"opencpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.10.2+dfsg-1","1:5.12.4+dfsg-1"]}],"references":[{"url":"https://jihoo-portfolio.vercel.app/posts/opencpn-rce-command-injection"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-56814"},{"url":"https://github.com/advisories/GHSA-wvcq-xvv7-c8m8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-56814","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-56814","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-56814","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-56814","description":"A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters.","status":"published","published":"2026-06-15T00:00:00Z","modified":"2026-06-15T20:23:21.227Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:32:26.320248Z"}],"euvd":[{"id":"EUVD-2025-210154","description":"A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters.","status":"published","published":"2026-06-15T00:00:00Z","modified":"2026-06-15T20:23:21Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:41.428781Z"}],"ghsa":[{"id":"GHSA-wvcq-xvv7-c8m8","title":"A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to...","description":"A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters.","status":"published","published":"2026-06-15T21:30:37Z","modified":"2026-06-15T21:30:42Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:08:47.002211Z"}],"nvd":[{"id":"CVE-2025-56814","description":"A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters.","status":"published","published":"2026-06-15T20:16:24.587Z","modified":"2026-10-13T10:10:00.193Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:12:02.535029Z"}],"osv":[{"id":"DEBIAN-CVE-2025-56814","description":"A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters.","status":"withdrawn","published":"2026-06-15T20:16:24.587Z","modified":"2026-07-18T20:00:43.448553253Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"UBUNTU-CVE-2025-56814","description":"A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters.","status":"published","published":"2026-06-15T20:16:00Z","modified":"2026-10-17T12:57:09.088097039Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.817402Z"}]}}