CVE-2025-11900 | The iSherlock developed by HGiga has an OS Command Injection… | CVSS 9.8 CRITICAL

Description

The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

Metadata

CVE ID: CVE-2025-11900
State: PUBLISHED
Assigner: twcert
Reserved: 2025-10-17 02:18 UTC
Published: 2025-10-17 03:50 UTC
Last updated: 2025-10-17 14:25 UTC
Primary CWE: CWE-78
CWE-78 Improper Neutralization of Special Elements used in a…
Vendor / Product: HGiga / iSherlock 4.5
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (4)

Vendor	Product	Platform	Versions
HGiga	iSherlock 4.5	—	0 < 774
HGiga	iSherlock 4.5	—	0 < 440
HGiga	iSherlock 5.5	—	0 < 774
HGiga	iSherlock 5.5	—	0 < 440

Weakness (CWE)

CWE	Source	Description
CWE-78	cna	CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)