CVE-2025-3705

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-3705
A physical attacker with no privileges can gain full control of the affected device due to improper neutralization of special elements used in an OS Command ('OS Command Injection') when loading a config file from a USB drive.

6.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://certvde.com/en/advisories/VDE-2025-030
Configurations

No configuration.

History

08 Jul 2025, 16:18

Type Values Removed Values Added
Summary
  • (es) Un atacante físico sin privilegios puede obtener control total del dispositivo afectado debido a la neutralización incorrecta de elementos especiales utilizados en un comando del sistema operativo ('Inyección de comando del sistema operativo') al cargar un archivo de configuración desde una unidad USB.

07 Jul 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-07 10:15

Updated : 2025-07-08 16:18

NVD link : CVE-2025-3705

Mitre link : CVE-2025-3705

CVE.ORG link : CVE-2025-3705

JSON object : View

Products Affected

No product.

CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')