Cyber Posture

CVE-2025-15388

High

Published: 31 December 2025

Published
31 December 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0048 65.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

SI-10 requires input validation at entry points, directly preventing OS command injection by blocking arbitrary commands in VPN Firewall inputs.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates timely flaw remediation, directly addressing this specific command injection vulnerability through patching the affected VPN Firewall software.

SI-9 Information Input Restrictions good match
prevent

SI-9 enforces input restrictions like type and format limits, preventing authenticated attackers from injecting executable OS commands remotely.

Security SummaryAI

CVE-2025-15388 is an OS Command Injection vulnerability (CWE-78) affecting the VPN Firewall developed by QNO Technology. Published on 2025-12-31, this flaw enables authenticated remote attackers to inject arbitrary OS commands, which are then executed on the server. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting its high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.

Attackers require only low privileges, such as those of an authenticated user, to exploit the vulnerability remotely over the network without user interaction. Successful exploitation allows execution of arbitrary operating system commands on the server, granting attackers the ability to achieve full control, including data exfiltration, system modification, or disruption of services.

Mitigation details and related advisories are provided by Taiwan CERT (TWCERT) at https://www.twcert.org.tw/en/cp-139-10614-dee41-2.html and https://www.twcert.org.tw/tw/cp-132-10613-e1780-1.html.

Details

CWE(s)
CWE-78

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

The OS command injection vulnerability in the network-accessible VPN Firewall enables exploitation of public-facing applications (T1190), exploitation of remote services (T1210), and arbitrary command execution via Unix Shell (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References