Arbitrary Code Execution Vulnerability in MSoft MFlash Application
CVE-2025-9060

9.1CRITICAL

Key Information:

Vendor

Msoft

Status
Mflash
Vendor
CVE Published:
15 August 2025

What is CVE-2025-9060?

A vulnerability exists in the MSoft MFlash application, enabling the execution of arbitrary code on the server. This flaw arises from inadequate validation of parameters in the integration configuration functionality accessible solely to MFlash administrators. To mitigate this issue, users are advised to apply the hotfix 8.2-653 dated November 6, 2025, or later.

Affected Version(s)

MFlash 8.0

References

https://github.com/klsecservices/Advisories/blob/master/K...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The vulnerability was discovered by Marsel Shagiev and Evgeny Velikoivanenko from Kaspersky (https://kaspersky.com)
.
CVE-2025-9060 : Arbitrary Code Execution Vulnerability in MSoft MFlash Application