{"id":"CVE-2025-6225","state":"PUBLISHED","title":"Command injection in Kieback&Peter Neutrino-GLT","description":"Kieback&Peter Neutrino-GLT product is used for building management. It's web component \"SM70 PHWEB\" is vulnerable to shell command injection via login form. The injected commands would execute with low privileges. The vulnerability has been fixed in version 9.40.02","publishedAt":"2026-01-07T13:00:46.715Z","updatedAt":"2026-01-07T14:12:33.502Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N","source":"CERT-PL"},"assigner":"CERT-PL","products":["Kieback&Peter Neutrino-GLT"],"affected":[{"vendor":"Kieback&Peter","product":"Neutrino-GLT","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"9.40.02","versionType":"custom"}],"modules":["SM70 PHWEB"]}],"references":["https://cert.pl/en/posts/2026/01/CVE-2025-6225/"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/6xxx/CVE-2025-6225.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-6225","state":"PUBLISHED","datePublished":"2026-01-07T13:00:46.715Z","dateUpdated":"2026-01-07T14:12:33.502Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2025-06-18T09:58:30.445Z"},"containers":{"cna":{"title":"Command injection in Kieback&Peter Neutrino-GLT","descriptions":[{"lang":"en","value":"Kieback&Peter Neutrino-GLT product is used for building management. It's web component \"SM70 PHWEB\" is vulnerable to shell command injection via login form. The injected commands would execute with low privileges. The vulnerability has been fixed in version 9.40.02"}],"affected":[{"vendor":"Kieback&Peter","product":"Neutrino-GLT","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"9.40.02","versionType":"custom"}],"modules":["SM70 PHWEB"]}],"references":[{"url":"https://cert.pl/en/posts/2026/01/CVE-2025-6225/"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2026-01-07T13:00:46.715Z"},"credits":[{"lang":"en","type":"finder","value":"Jan Barszcz"}],"datePublic":"2026-01-07T13:38:00.000Z","impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-07T14:12:25.758893Z","id":"CVE-2025-6225","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-07T14:12:33.502Z"}}]}}}