Command Injection Vulnerability in ESAFENET DSM by ESAFENET
CVE-2025-1845

5.3MEDIUM

Key Information:

Vendor

Esafenet

Status
Dsm
Vendor
CVE Published:
3 March 2025

Badges

👾 Exploit Exists

What is CVE-2025-1845?

A command injection vulnerability exists in ESAFENET DSM version 3.1.2, specifically affecting the 'examExportPDF' function within the file '/admin/plan/examExportPDF'. This flaw allows attackers to manipulate the 's' argument and potentially execute arbitrary commands on the server. The vulnerability can be exploited remotely, making it a significant risk for users. Despite early disclosures to the vendor, no response or patch has been issued, leaving the product exposed to possible exploitation.

Affected Version(s)

DSM 3.1.2

References

https://vuldb.com/?id.298111
vdb-entrytechnical-description
https://vuldb.com/?ctiid.298111
signaturepermissions-required
https://vuldb.com/?submit.505009
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

207556249 (VulDB User)
.
CVE-2025-1845 : Command Injection Vulnerability in ESAFENET DSM by ESAFENET