CVE-2025-7097

A vulnerability, which was classified as critical, has been found in Comodo Internet Security Premium 12.3.4.8162. This issue affects some unknown processing of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation of the argument binary/params leads to os command injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Configurations

No configuration.

History

08 Jul 2025, 16:18

Type Values Removed Values Added
Summary
  • (es) Se ha detectado una vulnerabilidad clasificada como crítica en Comodo Internet Security Premium 12.3.4.8162. Este problema afecta a un procesamiento desconocido del archivo cis_update_x64.xml del componente Manifest File Handler. La manipulación del argumento binary/params provoca la inyección de comandos del sistema operativo. El ataque puede ejecutarse en remoto. Es un ataque de complejidad bastante alta. Parece difícil de explotar. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta divulgación, pero no respondió.

07 Jul 2025, 16:15

Type Values Removed Values Added
References
  • () https://drive.google.com/file/d/1qnWarYsTSc5_sV6o8ULv0LBvGfKKXPxn/view -

06 Jul 2025, 23:15

Type Values Removed Values Added
New CVE

Information

Published : 2025-07-06 23:15

Updated : 2025-07-08 16:18


NVD link : CVE-2025-7097

Mitre link : CVE-2025-7097

CVE.ORG link : CVE-2025-7097


JSON object : View

Products Affected

No product.

CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')