CVE-2025-0396
Published: 12 January 2025
Description
A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading to version 2.11.22 is able to address this issue. It is recommended to upgrade the affected component.
Security Summary
CVE-2025-0396 is a critical command injection vulnerability affecting the shouldAcceptNewConnection function in the XPC Service component of exelban/stats up to version 2.11.21. The issue, associated with CWE-74 and CWE-77, allows manipulation that leads to arbitrary command execution and has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability on the affected host with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, enabling command injection that facilitates local privilege escalation.
Advisories recommend upgrading to exelban/stats version 2.11.22, which addresses the issue, as detailed in the GitHub release notes at https://github.com/exelban/stats/releases/tag/v2.11.22. Additional details are available from VulDB entries at https://vuldb.com/?ctiid.291269, https://vuldb.com/?id.291269, and https://vuldb.com/?submit.473229, as well as analysis at https://winslow1984.com/books/cve-collection/page/stats-v21122-local-privilege-escalation.
Details
- CWE(s)