CVE-2025-67840: OS Command Injection
Multiple authenticated OS command injection vulnerabilities exist in the Cohesity (formerly Stone Ram) TranZman 4.0 Build 14614 through TZM1757588060SEP2025FULL.depot web application API endpoints (including Scheduler and Actions pages). The appliance directly concatenates user-controlled parameters into system commands without sufficient sanitisation, allowing an authenticated admin user to inject and execute arbitrary OS commands with root privileges. An attacker can intercept legitimate requests (e.g. during job creation or execution) using a proxy and modify parameters to include shell metacharacters, achieving remote code execution on the appliance. This completely bypasses the intended CLISH restricted shell confinement and results in full system compromise. The vulnerabilities persist in Release 4.0 Build 14614 including the latest patch (as of the time of testing) TZM1757588060SEP2025FULL.depot.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67840?
CVE-2025-67840 is classified with critical severity due to its potential for remote command execution.
How do I fix CVE-2025-67840?
To mitigate CVE-2025-67840, users should update to the latest version of Cohesity TranZman that addresses these vulnerabilities.
What are the affected versions of CVE-2025-67840?
CVE-2025-67840 affects Cohesity TranZman version 4.0 Build 14614.
What actions should be taken if CVE-2025-67840 is exploited?
If CVE-2025-67840 is exploited, immediate steps should include isolating the affected system and conducting an incident response.
Can CVE-2025-67840 be exploited remotely?
Yes, CVE-2025-67840 can be exploited remotely due to the vulnerable API endpoints allowing unauthorized command execution.