{"id":"CVE-2025-9000","aliases":["EUVD-2025-24966","GHSA-4x54-68wr-6gp9"],"status":"published","title":"Mechrevo Control Center GX V2 reg File uncontrolled search path","description":"A vulnerability was detected in Mechrevo Control Center GX V2 5.56.51.48. Impacted is an unknown function of the component reg File Handler. The manipulation results in uncontrolled search path. The attack needs to be approached locally. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used.","severity":{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00181,"percentile":0.07674,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-426","CWE-427"],"published":"2025-08-15T01:32:06Z","modified":"2026-10-07T09:31:26Z","products":[{"vendor":"mechrevo","product":"control center gx v2"},{"vendor":"mechrevo","product":"control_center_gx_v2"}],"references":[{"url":"https://vuldb.com/vuln/320029","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/320029/cti","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2025-9000","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/624903","tags":["third-party-advisory"]},{"url":"https://drive.proton.me/urls/7QYSEW6734#H3N4fQ3mw6gX","tags":["exploit","Broken Link"]},{"url":"https://vuldb.com/?submit.624903","tags":["exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9000"},{"url":"https://vuldb.com/?ctiid.320029"},{"url":"https://vuldb.com/?id.320029"},{"url":"https://github.com/advisories/GHSA-4x54-68wr-6gp9"}],"sources":{"cve":[{"id":"CVE-2025-9000","title":"Mechrevo Control Center GX V2 reg File uncontrolled search path","description":"A vulnerability was detected in Mechrevo Control Center GX V2 5.56.51.48. Impacted is an unknown function of the component reg File Handler. The manipulation results in uncontrolled search path. The attack needs to be approached locally. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used.","status":"published","published":"2025-08-15T01:32:06.506Z","modified":"2026-10-07T06:33:40.717Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","level":"high","assessor":"cna"},{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","level":"high","assessor":"cna"},{"version":"2.0","score":6,"vector":"AV:L/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR","assessor":"cna"}],"cwes":["CWE-427","CWE-426"],"updated_at":"2026-11-02T14:32:33.755525Z"}],"euvd":[{"id":"EUVD-2025-24966","description":"A vulnerability was detected in Mechrevo Control Center GX V2 5.56.51.48. Impacted is an unknown function of the component reg File Handler. The manipulation results in uncontrolled search path. The attack needs to be approached locally. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used.","status":"published","published":"2025-08-15T01:32:06Z","modified":"2026-10-07T06:33:40Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"updated_at":"2026-11-02T17:27:35.926265Z"}],"ghsa":[{"id":"GHSA-4x54-68wr-6gp9","title":"A vulnerability was found in Mechrevo Control Center GX V2 5.56.51.48. Affected by this...","description":"A vulnerability was found in Mechrevo Control Center GX V2 5.56.51.48. Affected by this vulnerability is an unknown functionality of the component reg File Handler. The manipulation leads to uncontrolled search path. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-08-15T03:30:30Z","modified":"2026-10-07T09:31:26Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":6.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T15:12:53.496212Z"}],"nvd":[{"id":"CVE-2025-9000","description":"A vulnerability was detected in Mechrevo Control Center GX V2 5.56.51.48. Impacted is an unknown function of the component reg File Handler. The manipulation results in uncontrolled search path. The attack needs to be approached locally. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used.","status":"published","published":"2025-08-15T02:15:27.937Z","modified":"2026-10-07T07:16:56.41Z","cvss":[{"version":"4.0","score":6.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6,"vector":"AV:L/AC:H/Au:S/C:C/I:C/A:C","level":"medium","assessor":"secondary"}],"cwes":["CWE-426","CWE-427"],"updated_at":"2026-11-02T14:11:23.594522Z"}]}}