CVE-2025-20016

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation. A user with an administrative privilege who logged in to the web management page of the affected product may execute an arbitrary OS command.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
Y'S corporationSTEALTHONE D220firmware v6.03.02 and earlier
Y'S corporationSTEALTHONE D340firmware v6.03.02 and earlier
Y'S corporationSTEALTHONE D440firmware v7.00.10 and earlier

References

Timeline

Published
Jan 14, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-200176.7Uncontrolled search path for some Intel(R) oneAPI Toolkit and component software installers may allow an authenticated user to potentially eCVE-2025-200188.4Untrusted pointer dereference for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privileCVE-2025-20026.0CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials whCVE-2025-200215.5in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.CVE-2025-200225.7Insufficient control flow management for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a privileged user to poCVE-2025-200236.7Incorrect default permissions for some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable esCVE-2025-200245.3in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. ThiCVE-2025-200254.4Uncontrolled recursion for some TinyCBOR libraries maintained by Intel(R) before version 0.6.1 may allow an authenticated user to potentiallCVE-2025-200266.1Out-of-bounds read for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to poCVE-2025-200277.1Improper input validation in the UEFI WheaERST module for some Intel(R) reference platforms may allow an escalation of privilege. System sofCVE-2025-200287.1Time-of-check time-of-use race condition in the WheaERST SMM module for some Intel(R) reference platforms may allow an escalation of privileCVE-2025-200298.8Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker
CVE-2025-20016: High severity, CVSS 7.2 | Vulnix