CVE-2025-3363: HGiga iSherlock - OS Command Injection
Published Apr 8, 2025
·Updated
The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.
Affected Software
1 affected component
Hgiga iSherlock
Remediation
Information
For iSherlock 4.5, please update package iSherlock-user-4.5 to version 236 or later.
For iSherlock 5.5, please update package iSherlock-user-5.5 to version 236 or later.
Event History
Apr 8, 2025
CVE Published
via MITRE·02:11 AM
Data Sourced
via MITRE·02:11 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeakness
Jun 20, 57255
Event
via FIRST·02:42 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-3363?
CVE-2025-3363 is considered a critical vulnerability due to its potential for remote command execution.
2
How do I fix CVE-2025-3363?
To fix CVE-2025-3363, apply the latest security patches provided by HGiga or implement input validation to prevent command injection.
3
What type of attacks can CVE-2025-3363 facilitate?
CVE-2025-3363 can facilitate unauthorized remote command execution attacks, leading to potential compromise of the server.
4
Who is affected by CVE-2025-3363?
Users of HGiga's iSherlock web service are primarily affected by CVE-2025-3363.
5
Is authentication required to exploit CVE-2025-3363?
No, CVE-2025-3363 can be exploited by unauthenticated attackers.