CVE-2025-27364: OS Command Injection
In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implant) compilation functionality of the server. This allows remote attackers to execute arbitrary code on the server that Caldera is running on via a crafted web request to the Caldera server API used for compiling and downloading of Caldera's Sandcat or Manx agent (implants). This web request can use the gcc -extldflags linker flag with sub-commands.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27364?
CVE-2025-27364 is classified as a critical Remote Code Execution vulnerability.
How do I fix CVE-2025-27364?
To mitigate CVE-2025-27364, upgrade MITRE Caldera to versions 5.0.0 or later to ensure security against this vulnerability.
What versions of MITRE Caldera are affected by CVE-2025-27364?
CVE-2025-27364 affects MITRE Caldera versions from 4.2.0 up to, but not including, 5.0.0.
What type of vulnerability is CVE-2025-27364?
CVE-2025-27364 is a Remote Code Execution vulnerability that allows attackers to execute arbitrary code on the server.
Where can I find more information about CVE-2025-27364?
For more information about CVE-2025-27364, check the official MITRE Caldera releases and security advisory.