VulnerabilityAnalyzed
CVE-2025-65076
WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server.
HIGH 8.6EPSS 0.34%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to read or delete any file on the server using path traversal in the ilog script. This script is being run with root privileges. This issue was fixed in version 6.44.44
- CVSS 4.0
- 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.34% probability · 28th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- wavestore/video management software server
- Source
- cvd@cert.pl
References
- https://cert.pl/en/posts/2025/12/CVE-2025-65074Third Party Advisory
- https://www.wavestore.com/products/video-management-softwareProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.