CVE-2025-3363 - HGiga iSherlock - OS Command Injection

Back Back to CVE browser

CRITICAL

HGiga iSherlock - OS Command Injection

Published Apr 8, 2025

9.8

CRITICAL

CVSS 3.1

EPSS 1.34%

Description

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

Affected products

Vendor HGiga Product iSherlock 4.5 Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <236
Vendor HGiga Product iSherlock 5.5 Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <236

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

HGiga

iSherlock 4.5

unaffected

Version	Status	Constraints
0	affected	<236

HGiga

iSherlock 5.5

unaffected

Version	Status	Constraints
0	affected	<236

Remediation

Vendor solution

For iSherlock 4.5, please update package iSherlock-user-4.5 to version 236 or later. For iSherlock 5.5, please update package iSherlock-user-5.5 to version 236 or later.

Weaknesses (1)

CWE-78

OS Command Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-10413
Advisory
https://www.twcert.org.tw/en/cp-139-10056-c553a-2.html
third-party-advisory
https://www.twcert.org.tw/tw/cp-132-10054-84588-1.html
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-10413		Advisory
https://www.twcert.org.tw/en/cp-139-10056-c553a-2.html		third-party-advisory
https://www.twcert.org.tw/tw/cp-132-10054-84588-1.html		third-party-advisory