CVE-2025-2605

🗓️ 02 May 2025 12:39:39Reported by HoneywellType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 86 Views

CVE-2025-2605 allows privilege abuse in Honeywell MB-Secure before V12.53 and PRO before V03.09.

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability of the microprogrammed control panel software for Honeywell MB-Secure and MB-Secure PRO devices arises from the lack of measures taken to neutralize special elements used in the operating system’s command sequence. This allows attackers to execute arbitrary commands with elevated privileges.	7 May 202500:00	–	bdu_fstec
Circl	CVE-2025-2605	2 May 202513:15	–	circl
CNNVD	Honeywell MB-Secure 安全漏洞	2 May 202500:00	–	cnnvd
Cvelist	CVE-2025-2605 Authenticated command injection	2 May 202512:39	–	cvelist
EUVD	EUVD-2025-13247	3 Oct 202520:07	–	euvd
NVD	CVE-2025-2605	2 May 202513:15	–	nvd
OSV	CVE-2025-2605	2 May 202513:15	–	osv
Packet Storm	📄 Honeywell MB-Secure Command Injection	19 May 202500:00	–	packetstorm
Positive Technologies	PT-2025-18774 · Honeywell · Honeywell Mb-Secure +1	1 May 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-2605: Improper Neutralization of Special Elements used in an OS Command	2 May 202500:00	–	rapid7

NVD

Node

AND

honeywell mb-secure_firmwareRange11.04–12.53

honeywell mb-secureMatch-

Node

AND

honeywell mb-secure_pro_firmwareRange01.06–03.09

honeywell mb-secure_proMatch-

[
  {
    "defaultStatus": "affected",
    "product": "MB-Secure",
    "vendor": "Honeywell",
    "versions": [
      {
        "lessThan": "V12.53",
        "status": "affected",
        "version": "V11.04",
        "versionType": "semver"
      }
    ]
  }
]