{"id":"CVE-2025-57457","aliases":["EUVD-2025-33285","GHSA-63j3-6953-p6pv"],"status":"published","title":"An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows...","description":"An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the \"IP Addr\" parameter.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00981,"percentile":0.62696,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2025-10-08T00:00:00Z","modified":"2026-11-05T22:10:00Z","exploits":[{"source":"pocgithub","id":"restdone/CVE-2025-57457","title":"restdone/CVE-2025-57457","date":"2025-10-02","url":"https://github.com/restdone/CVE-2025-57457"}],"references":[{"url":"https://github.com/restdone/CVE-2025-57457/tree/main"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57457"},{"url":"http://curo.com"},{"url":"https://github.com/advisories/GHSA-63j3-6953-p6pv"}],"sources":{"cve":[{"id":"CVE-2025-57457","description":"An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the \"IP Addr\" parameter.","status":"published","published":"2025-10-08T00:00:00Z","modified":"2026-07-05T01:14:16.397Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:34.773122Z"}],"euvd":[{"id":"EUVD-2025-33285","description":"An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the \"IP Addr\" parameter.","status":"published","published":"2025-10-08T00:00:00Z","modified":"2026-07-05T01:14:16Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:15.276406Z"}],"ghsa":[{"id":"GHSA-63j3-6953-p6pv","title":"An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows...","description":"An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the \"IP Addr\" parameter.","status":"published","published":"2025-10-08T21:30:34Z","modified":"2025-10-08T21:30:34Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:03:54.080126Z"}],"nvd":[{"id":"CVE-2025-57457","description":"An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the \"IP Addr\" parameter.","status":"published","published":"2025-10-08T19:15:44.563Z","modified":"2026-11-05T22:10:00.203Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-05T23:57:15.690201Z"}]}}