{"id":"CVE-2025-9000","state":"PUBLISHED","title":"Mechrevo Control Center GX V2 reg File uncontrolled search path","description":"A vulnerability was detected in Mechrevo Control Center GX V2 5.56.51.48. Impacted is an unknown function of the component reg File Handler. The manipulation results in uncontrolled search path. The attack needs to be approached locally. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used.","publishedAt":"2025-08-15T01:32:06.506Z","updatedAt":"2026-10-07T06:33:40.717Z","severity":{"score":7.3,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Mechrevo Control Center GX V2"],"affected":[{"vendor":"Mechrevo","product":"Control Center GX V2","versions":[{"version":"5.56.51.48","status":"affected"}],"cpes":["cpe:2.3:a:mechrevo:control_center_gx_v2:*:*:*:*:*:*:*:*"],"modules":["reg File Handler"]}],"references":["https://vuldb.com/vuln/320029","https://vuldb.com/vuln/320029/cti","https://vuldb.com/cve/CVE-2025-9000","https://vuldb.com/submit/624903","https://drive.proton.me/urls/7QYSEW6734#H3N4fQ3mw6gX","https://vuldb.com/?submit.624903"],"weaknesses":["CWE-427","CWE-426"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/9xxx/CVE-2025-9000.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-9000","state":"PUBLISHED","datePublished":"2025-08-15T01:32:06.506Z","dateUpdated":"2026-10-07T06:33:40.717Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-08-13T18:50:38.624Z"},"containers":{"cna":{"title":"Mechrevo Control Center GX V2 reg File uncontrolled search path","descriptions":[{"lang":"en","value":"A vulnerability was detected in Mechrevo Control Center GX V2 5.56.51.48. Impacted is an unknown function of the component reg File Handler. The manipulation results in uncontrolled search path. The attack needs to be approached locally. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used."}],"affected":[{"vendor":"Mechrevo","product":"Control Center GX V2","versions":[{"version":"5.56.51.48","status":"affected"}],"cpes":["cpe:2.3:a:mechrevo:control_center_gx_v2:*:*:*:*:*:*:*:*"],"modules":["reg File Handler"]}],"references":[{"url":"https://vuldb.com/vuln/320029","name":"VDB-320029 | Mechrevo Control Center GX V2 reg File uncontrolled search path","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/320029/cti","name":"VDB-320029 | CTI Indicators (IOB, IOC, TTP)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2025-9000","name":"CVE-2025-9000 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/624903","name":"Submit #624903 | Mechrevo Control Center GX V2 5.56.51.48 Insecure .reg File Handler","tags":["third-party-advisory"]},{"url":"https://drive.proton.me/urls/7QYSEW6734#H3N4fQ3mw6gX","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.3,"vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","baseSeverity":"HIGH"}},{"cvssV3_1":{"version":"3.1","baseScore":7,"vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7,"vectorString":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":6,"vectorString":"AV:L/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-427","type":"CWE","lang":"en","description":"Uncontrolled Search Path"}]},{"descriptions":[{"cweId":"CWE-426","type":"CWE","lang":"en","description":"Untrusted Search Path"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-10-07T06:33:40.717Z"},"timeline":[{"time":"2025-08-13T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-08-13T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-10-06T18:10:24.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Oleksandr Preobrazhenskyy","type":"finder"},{"lang":"en","value":"pipapupa (VulDB User)","type":"reporter"},{"lang":"en","value":"pipapupa (VulDB User)","type":"analyst"}],"x_generator":["VulDB PVTS v202610"]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://vuldb.com/?submit.624903","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-08-15T12:48:33.252438Z","id":"CVE-2025-9000","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-08-15T12:48:36.237Z"}}]}}}