« Volver al listado

CVE-2025-0396

Estado: AplazadaAlta (8.5)—

A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading to version 2.11.22 is able to address this issue. It is recommended to upgrade the affected component.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L + PR:L sin UI:R → escalada de privilegios local (T1068). CWE-74/77 y 'command injection' en función XPC → ejecución de comandos (T1059) como impacto.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationBehavior Prevention on Endpoint

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Pvpgn — StatsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-0396",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-0396",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-13T15:17:48.258270Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.1,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.5,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "vendor": "exelban",
          "modules": [
            "XPC Service"
          ],
          "product": "stats",
          "versions": [
            {
              "status": "affected",
              "version": "2.11.0"
            },
            {
              "status": "affected",
              "version": "2.11.1"
            },
            {
              "status": "affected",
              "version": "2.11.2"
            },
            {
              "status": "affected",
              "version": "2.11.3"
            },
            {
              "status": "affected",
              "version": "2.11.4"
            },
            {
              "status": "affected",
              "version": "2.11.5"
            },
            {
              "status": "affected",
              "version": "2.11.6"
            },
            {
              "status": "affected",
              "version": "2.11.7"
            },
            {
              "status": "affected",
              "version": "2.11.8"
            },
            {
              "status": "affected",
              "version": "2.11.9"
            },
            {
              "status": "affected",
              "version": "2.11.10"
            },
            {
              "status": "affected",
              "version": "2.11.11"
            },
            {
              "status": "affected",
              "version": "2.11.12"
            },
            {
              "status": "affected",
              "version": "2.11.13"
            },
            {
              "status": "affected",
              "version": "2.11.14"
            },
            {
              "status": "affected",
              "version": "2.11.15"
            },
            {
              "status": "affected",
              "version": "2.11.16"
            },
            {
              "status": "affected",
              "version": "2.11.17"
            },
            {
              "status": "affected",
              "version": "2.11.18"
            },
            {
              "status": "affected",
              "version": "2.11.19"
            },
            {
              "status": "affected",
              "version": "2.11.20"
            },
            {
              "status": "affected",
              "version": "2.11.21"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-01-12T12:15:17.963",
  "references": [
    {
      "url": "https://github.com/exelban/stats/releases/tag/v2.11.22",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?ctiid.291269",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?id.291269",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?submit.473229",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://winslow1984.com/books/cve-collection/page/stats-v21122-local-privilege-escalation",
      "source": "cna@vuldb.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        },
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading to version 2.11.22 is able to address this issue. It is recommended to upgrade the affected component."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado una vulnerabilidad, que se ha clasificado como crítica, en exelban stats hasta la versión 2.11.21. Este problema afecta a la función shouldAcceptNewConnection del componente XPC Service. La manipulación conduce a la inyección de comandos. Es posible lanzar el ataque en el host local. La actualización a la versión 2.11.22 puede solucionar este problema. Se recomienda actualizar el componente afectado."
    }
  ],
  "lastModified": "2026-06-17T08:26:23.613",
  "sourceIdentifier": "cna@vuldb.com"
}