CVE-2025-20055

🗓️ 14 Jan 2025 09:33:46Reported by jpcertType

OS command injection vulnerability in STEALTHONE D220/D340 network servers by Y'S corporation.

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of the microprogrammed software for the STEALTHONE D220 and D340 network storage devices arises from the lack of measures taken to neutralize the special elements used in the operating system’s command set. This allows a hacker to execute arbitrary commands.	28 Jan 202500:00	–	bdu_fstec
Circl	CVE-2025-20055	14 Jan 202509:38	–	circl
CNNVD	STEALTHONE D220和STEALTHONE D340 操作系统命令注入漏洞	14 Jan 202500:00	–	cnnvd
CVE	CVE-2025-20055	14 Jan 202509:33	–	cve
EUVD	EUVD-2025-2145	3 Oct 202520:07	–	euvd
Japan Vulnerability Notes	Multiple vulnerabilities in STEALTHONE D220/D340/D440	6 Feb 202509:27	–	jvn
NVD	CVE-2025-20055	14 Jan 202510:15	–	nvd
Positive Technologies	PT-2025-1295 · Y'S · Stealthone D220 +1	6 Jan 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-20055	6 Feb 202502:30	–	redhatcve
Vulnrichment	CVE-2025-20055	14 Jan 202509:33	–	vulnrichment

[
  {
    "vendor": "Y'S corporation",
    "product": "STEALTHONE D220",
    "versions": [
      {
        "version": "firmware v6.03.02 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Y'S corporation",
    "product": "STEALTHONE D340",
    "versions": [
      {
        "version": "firmware v6.03.02 and earlier",
        "status": "affected"
      }
    ]
  }
]

Source	Link
stealthone	www.stealthone.net/product_info/d220-d340%e3%80%8cv6-03-03%e3%80%8d%e5%8f%8a%e3%81%b3d440%e3%80%8cv7-00-11%e3%80%8d%e3%83%95%e3%82%a1%e3%83%bc%e3%83%a0%e3%82%a6%e3%82%a7%e3%82%a2%e3%82%92%e3%83%aa%e3%83%aa%e3%83%bc%e3%82%b9%e8%87%b4/
jvn	www.jvn.jp/en/vu/JVNVU99653331/

14 Jan 2025 09:33Current

CVSS 3.19.8

EPSS0.01817

CWE-78