{"id":"CVE-2025-48501","state":"PUBLISHED","title":"An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed on the server where t","description":"An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed on the server where the product is running.","publishedAt":"2025-07-07T04:51:39.574Z","updatedAt":"2025-07-07T17:51:06.538Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"jpcert"},"assigner":"jpcert","products":["Nimesa Nimesa Backup and Recovery"],"affected":[{"vendor":"Nimesa","product":"Nimesa Backup and Recovery","versions":[{"version":"v2.3","status":"affected"}]},{"vendor":"Nimesa","product":"Nimesa Backup and Recovery","versions":[{"version":"v2.4","status":"affected"}]}],"references":["https://aws.amazon.com/marketplace/seller-profile?id=08fb48d1-5d60-4feb-93c6-c0c219278a2c","https://jvn.jp/en/jp/JVN88251376/"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/48xxx/CVE-2025-48501.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-48501","state":"PUBLISHED","datePublished":"2025-07-07T04:51:39.574Z","dateUpdated":"2025-07-07T17:51:06.538Z","assignerShortName":"jpcert","assignerOrgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateReserved":"2025-07-02T08:23:23.992Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed on the server where the product is running."}],"affected":[{"vendor":"Nimesa","product":"Nimesa Backup and Recovery","versions":[{"version":"v2.3","status":"affected"}]},{"vendor":"Nimesa","product":"Nimesa Backup and Recovery","versions":[{"version":"v2.4","status":"affected"}]}],"references":[{"url":"https://aws.amazon.com/marketplace/seller-profile?id=08fb48d1-5d60-4feb-93c6-c0c219278a2c"},{"url":"https://jvn.jp/en/jp/JVN88251376/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_0":{"version":"3.0","baseSeverity":"CRITICAL","baseScore":9.8,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}},{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV4_0":{"version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"Improper neutralization of special elements used in an OS command ('OS Command Injection')","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"jpcert","orgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateUpdated":"2025-07-07T04:51:39.574Z"},"tags":["unsupported-when-assigned"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-07T17:50:54.621360Z","id":"CVE-2025-48501","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-07T17:51:06.538Z"}}]}}}