CVE-2025-1265

CVE-2025-1265 is an OS command injection vulnerability (CWE-78) in the Vinci Protocol Analyzer, published on 2025-02-20. The flaw carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating critical severity with network accessibility, low attack complexity, and requirements for only low privileges. It affects the Vinci Protocol Analyzer software, enabling attackers to escalate privileges and execute arbitrary code on the impacted system.

An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) without requiring user interaction (UI:N). Successful exploitation allows command injection, leading to privilege escalation and arbitrary code execution with high impacts on confidentiality, integrity, and availability (C/I/A:H), further amplified by a change in scope (S:C).

For mitigation details, refer to the CISA ICS Advisory ICSA-25-051-06 at https://www.cisa.gov/news-events/ics-advisories/icsa-25-051-06 and the vendor support page at https://elseta.com/support/.