CVE Updates (October 13 – 19, 2025)

Here are the CVE updates for the week of October 13th through 19th.

🔴 Critical Severity Vulnerabilities

SKYSEA Client View Improper Authentication Vulnerability (CISA KEV) | CVE-2016-7836

Description:
A vulnerability in SKYSEA Client View (version 11.221.03 and earlier) occurs due to how authentication is processed over the TCP connection between agents and the management console. When an attacker interacts with the management-console endpoint, they can exploit the flaw to achieve remote code execution on the affected systems. As a result, arbitrary code can execute within the vulnerable component’s context, giving attackers deep system access.

Potential Impacts:

• Remote Code Execution (RCE): Attackers may execute arbitrary code on affected hosts.
• Full Endpoint Compromise: Once compromised, endpoints can be controlled, allowing data theft, lateral movement, and payload deployment.
• Management Plane Risk: If attackers gain console access, they could alter management policies or manipulate endpoint configurations.
• Persistence & Reconnaissance: After compromise, attackers may install backdoors, gather credentials, and perform additional reconnaissance.

Mitigation Recommendations:

• Apply Vendor Patch or Upgrade: Immediately install the vendor’s security update or upgrade to a fixed version. If a specific patch exists for CVE-2016-7836, deploy it without delay.
• Restrict Network Access: Limit access to management-console TCP ports to trusted networks using firewalls or ACLs.
• Harden Authentication & Access Controls: Use strong, multi-factor authentication and apply least privilege to management accounts.
• Segment Management Infrastructure: Keep management servers on isolated VLANs or networks separate from user traffic.
• Monitor & Audit Continuously: Review logs for abnormal connections, repeated authentication failures, or unexpected processes.
• Incident Response: If compromise occurs, isolate affected systems, collect forensic evidence, and rotate credentials before restoring operations.
• Maintain Reliable Backups: Ensure backups are tested regularly and can support full recovery if needed.
• Coordinate with Vendor: Review vendor guidance for additional configuration hardening and indicators of compromise (IoCs).
• Increase User Awareness: Remind users to avoid suspicious emails or links, and decommission unsupported systems.
• Enhance Endpoint Detection: Keep EDR and antivirus updated to identify and block exploit attempts early.

Adobe Experience Manager Forms Code Execution Vulnerability (CISA KEV) | CVE-2025-54253

Description: A misconfiguration vulnerability in Adobe Experience Manager (AEM) versions 6.5.23 and earlier allows arbitrary code execution. Specifically, attackers can bypass security mechanisms and execute code remotely on the affected system. Since exploitation requires no user interaction, it poses a high risk and can extend beyond the directly vulnerable component.

Potential Impacts:

• Remote Code Execution (RCE): Attackers can run arbitrary code within the AEM server environment.
• System Compromise: Successful exploitation could lead to complete AEM takeover, including control of hosted applications.
• Data Breach: Sensitive stored content and user data may be exposed or stolen.
• Service Disruption: Attackers might alter, disable, or interrupt AEM operations and connected services.

Mitigation Recommendations:

• Upgrade AEM Promptly: Update to the latest version beyond 6.5.23 to eliminate the vulnerability.
• Restrict Access: Permit administrative and network access only from trusted IP addresses.
• Harden Configuration: Disable unused modules and minimize the attack surface.
• Deploy a Web Application Firewall (WAF): Detect and block potential exploitation attempts proactively.
• Monitor Logs Regularly: Inspect web and AEM server logs for abnormal activity or unauthorized access attempts.

Server-Side Request Forgery (SSRF) in Illia Cloud illia-Builder Allowing Internal Service Access | CVE-2025-60279

Description: A Server-Side Request Forgery (SSRF) flaw exists in Illia Cloud illia-Builder versions before v4.8.5. Authenticated users can manipulate the API to send arbitrary HTTP(S) requests on behalf of the application. Consequently, attackers can reach internal services and metadata endpoints that would normally be inaccessible. Furthermore, response differences may allow port scanning and enumeration of internal hosts.

Potential Impacts:

• Internal Network Exposure: Attackers can reach internal APIs, metadata services, or administrative endpoints.
• Port Enumeration: By comparing responses, attackers can identify active ports and services.
• Lateral Movement: Access to internal systems could enable broader compromise or privilege escalation.
• Data Exposure: Sensitive internal data might be retrieved or exfiltrated.

Mitigation Recommendations:

• Upgrade illia-Builder: Update to version 4.8.5 or later, as this issue is resolved in newer releases.
• Restrict Outbound Requests: Use egress rules to block requests to private network ranges.
• Validate User Input Strictly: Enforce URL validation to prevent internal IP or non-HTTP(S) requests.
• Implement Allowlists: Permit outbound traffic only to approved domains.
• Monitor Logs: Track outbound network requests and flag any directed toward internal addresses.

🟠 High Severity Vulnerabilities

Microsoft Windows Untrusted Pointer Dereference Vulnerability (CISA KEV) | CVE-2025-24990: Microsoft identified vulnerabilities in the Agere Modem driver (ltmdm64.sys), which was included by default in Windows systems. Consequently, Microsoft removed the vulnerable driver in the October 2025 cumulative update. Although this prevents exploitation, fax modem hardware that depends on this driver will stop functioning. Therefore, organizations should remove dependencies on affected hardware immediately.

Microsoft Windows Improper Access Control Vulnerability (CISA KEV) | CVE-2025-59230: An improper access control flaw affects the Windows Remote Access Connection Manager (RasMan). A local attacker could exploit insufficient permission validation to gain elevated privileges. Although exploitation requires local access, it could enable arbitrary code execution with SYSTEM-level rights.

Authenticated OS Command Injection in Ilevia EVE X1 Server Firmware | CVE-2025-34514: levia EVE X1 Server firmware versions 4.7.18.0.eden and earlier contain several authenticated command injection vulnerabilities. Exploiting these flaws lets an attacker run arbitrary system commands with the same privileges as the web server process. While Ilevia does not plan to issue a patch, users should apply configuration-based mitigations immediately.

Denial of Service via Read Timeout Enforcement Failure in IBM MQ | CVE-2025-36128: Improper read-timeout enforcement in IBM MQ versions 9.1 through 9.4 allows remote attackers to execute slowloris-style attacks. By maintaining multiple half-open connections, attackers can exhaust server resources and cause denial-of-service conditions, preventing legitimate connections.

🟡 Medium Severity Vulnerabilities

IGEL OS Use of a Key Past its Expiration Date Vulnerability (CISA KEV) | CVE-2025-47827: In IGEL OS versions prior to 11, the igel-flash-driver module fails to verify cryptographic signatures on SquashFS images correctly. Because of this oversight, attackers can supply unsigned or improperly signed images, which the system then mounts. This effectively bypasses Secure Boot protections and allows unverified root filesystems to run.

Rapid7 Velociraptor Incorrect Default Permissions Vulnerability (CISA KEV) | CVE-2025-6264: Velociraptor enables the collection and execution of VQL artifacts on endpoints. However, the Admin.Client.UpdateClientConfig artifact failed to enforce elevated permission requirements. As a result, users with the COLLECT_CLIENT capability could update client configurations improperly, executing arbitrary commands and taking control of endpoints. To mitigate, administrators should apply updated permissions and patch affected systems.

Cross-Site Scripting (XSS) in MCP OAuth Flow Allowing Arbitrary JavaScript Execution | CVE-2025-58747: In Dify versions up to 1.9.1, the MCP OAuth component incorrectly handles the authorization_url parameter. When connecting to a malicious MCP server, the attacker can inject a javascript: payload, which executes in the victim’s browser context. Therefore, this vulnerability enables arbitrary JavaScript execution through the OAuth flow.