CVE-2025-9588 | Improper Neutralization of Special Elements used in an OS Co… | CVSS 10.0 CRITICAL

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection. This issue affects enVision: before 250563.

Metadata

CVE ID: CVE-2025-9588
State: PUBLISHED
Assigner: TR-CERT
Reserved: 2025-08-28 13:36 UTC
Published: 2025-09-23 07:51 UTC
Last updated: 2026-06-05 11:09 UTC
Primary CWE: CWE-78
CWE-78 Improper Neutralization of Special Elements used in a…
Vendor / Product: Iron Mountain Archiving Services Inc. / enVision
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Iron Mountain Archiving Services Inc.	enVision	—	0 < 250563

Weakness (CWE)

CWE	Source	Description
CWE-78	cna	CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (2)