CVE-2025-27392: OS Command Injection
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when creating new VXLAN configurations. This could allow an authenticated highly-privileged remote attacker to execute arbitrary code on the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SCALANCE LPE9403 (6GK5998-3GS00-2AC2)to a version that resolves this vulnerability.Fixed in V4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27392?
CVE-2025-27392 is considered a high severity vulnerability due to the potential for arbitrary code execution by an authenticated attacker.
What versions of SCALANCE LPE9403 are affected by CVE-2025-27392?
All versions of SCALANCE LPE9403 prior to version 4.0 are affected by CVE-2025-27392.
How do I fix CVE-2025-27392?
To mitigate CVE-2025-27392, upgrade the SCALANCE LPE9403 firmware to version 4.0 or later.
What type of attack can be executed using CVE-2025-27392?
CVE-2025-27392 allows an authenticated highly-privileged remote attacker to execute arbitrary code on the affected device.
Is user authentication required to exploit CVE-2025-27392?
Yes, exploitation of CVE-2025-27392 requires the attacker to be an authenticated user with high privileges.