CVE-2025-67397
Published: 05 January 2026
Description
An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection.
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely identification, reporting, and correction of flaws like this command injection vulnerability through patching Passy to version 1.6.3 or later.
SI-10 mandates validation of information inputs such as crafted HTTP requests to block arbitrary command injection payloads.
SI-4 enables monitoring of system processes and activities to identify unauthorized command executions from exploitation attempts.
Security SummaryAI
CVE-2025-67397 is a command injection vulnerability (CWE-77) in Passy version 1.6.3. The flaw enables a remote authenticated attacker to execute arbitrary commands by sending a crafted HTTP request that incorporates a specific payload injection.
A remote attacker with high privileges can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation grants high impacts on confidentiality, integrity, and availability, along with a change in scope, resulting in a CVSS v3.1 base score of 9.1.
Research details for CVE-2025-67397, including a proof-of-concept, are published in the GitHub repository at https://github.com/giulioschiavone/Vulnerability-Research/tree/main/CVE-2025-67397. The official Passy website at https://www.passy.it/ provides further information on the software, where users should check for advisories or patches.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via crafted HTTP request in remote service directly enables public-facing application exploitation (T1190) and arbitrary command/script execution (T1059).