Cyber Posture

CVE-2025-28357

High

Published: 01 October 2025

Published
01 October 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0018 39.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-28357, published on 2025-10-01, is a CRLF injection vulnerability (CWE-93) in Neto CMS versions v6.313.0 through v6.314.0. The flaw allows attackers to execute arbitrary code by supplying a crafted HTTP request. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity, though it requires user interaction, such as tricking a user into processing a malicious request. Successful exploitation grants high-level impacts on confidentiality, integrity, and availability, culminating in arbitrary code execution on the targeted Neto CMS instance.

Advisories and further details are available at http://neto.com and https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-28357.md.

Details

CWE(s)
CWE-93

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CRLF injection in public-facing Neto CMS enables unauthenticated remote arbitrary code execution via crafted HTTP request, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References