CVE-2025-14500

🗓️ 23 Dec 2025 21:19:24Reported by zdiType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 30 Views

IceWarp14 X-File-Operation enables remote code execution without authentication via header handling flaw.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-14500	10 Dec 202505:00	–	circl
CNNVD	IceWarp 操作系统命令注入漏洞	23 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-14500 IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability	23 Dec 202521:19	–	cvelist
EUVD	EUVD-2025-205006	24 Dec 202500:30	–	euvd
NVD	CVE-2025-14500	23 Dec 202522:15	–	nvd
Positive Technologies	PT-2025-50579	10 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-14500	24 Dec 202521:19	–	redhatcve
The Hacker News	⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe-Coded Malware	9 Mar 202613:46	–	thn
Vulnrichment	CVE-2025-14500 IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability	23 Dec 202521:19	–	vulnrichment
Zero Day Initiative	IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability	10 Dec 202500:00	–	zdi

Vulners

Node

icewarp icewarpRange≤14.2.0.5

[
  {
    "vendor": "IceWarp",
    "product": "IceWarp",
    "versions": [
      {
        "version": "14.2.0.5",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-25-1072/

17 Jun 2026 08:36Current

9.6High risk

Vulners AI Score9.6

CVSS 39.8

EPSS0.01443

SSVC

CWE-78