« Volver al listado

CVE-2025-1782

Estado: AnalizadaCrítica (9.9)—

In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbitrary file in the PHP code allowing an attacker to do anything as the web server user. This flaw requires the attacker to be authenticated with a valid user account.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N, PR:L indica servicio remoto accesible con privs autenticadas (T1210). CWE-94 es code injection; sanitización deficiente permite incluir ficheros PHP arbitrarios (T1059). El atacante logra ejecución como usuario web, acceso a datos (T1005) y manipulación (T1565).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based Content

Tecnologías afectadas (2)

Avantfax — AvantfaxIfax — Hylafax

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-1782",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-1782",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-14T19:40:44.593155Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "repo": "https://sourceforge.net/projects/avantfax/",
          "vendor": "ifax",
          "product": "HylaFAX",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.1.*",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.2.0",
              "lessThan": "1.2.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.3.0",
              "lessThan": "1.3.2",
              "versionType": "semver"
            }
          ],
          "packageName": "HylaFAX",
          "collectionURL": "https://www.ifax.com/",
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://sourceforge.net/projects/avantfax/",
          "vendor": "ifax",
          "product": "AvantFAX",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.3.*",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.4.0",
              "lessThan": "3.4.1",
              "versionType": "semver"
            }
          ],
          "packageName": "AvantFAX",
          "collectionURL": "https://www.ifax.com/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-14T19:15:36.277",
  "references": [
    {
      "url": "https://www.ifax.com/security/CVE-2025-1782.html",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized \nbefore being used and can be misused to include an arbitrary file in the\n PHP code allowing an attacker to do anything as the web server user. \nThis flaw requires the attacker to be authenticated with a valid user account."
    },
    {
      "lang": "es",
      "value": "HylaFAX Enterprise Web Interface y AvantFAX, el elemento de formulario de idioma no se depura correctamente antes de su uso y puede usarse indebidamente para incluir un archivo arbitrario en el código PHP, lo que permite a un atacante realizar cualquier acción como usuario del servidor web. Esta falla requiere que el atacante se autentique con una cuenta de usuario válida."
    }
  ],
  "lastModified": "2026-08-06T15:26:04.700",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:avantfax:avantfax:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDF96013-AFFF-4B5D-9BBE-B50D9A3AB995",
              "versionEndExcluding": "3.4.1"
            },
            {
              "criteria": "cpe:2.3:a:ifax:hylafax:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "851A4B42-DD76-4FE0-A85B-D4C042264DBA",
              "versionEndExcluding": "1.2.1"
            },
            {
              "criteria": "cpe:2.3:a:ifax:hylafax:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "663D23B1-5135-4EF1-BF61-C108EB0CFD72",
              "versionEndExcluding": "1.3.2",
              "versionStartIncluding": "1.3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}