CVE-2025-60013

MediumCVSS 4.6/10Last modified Oct 8, 2026

Description

When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary system commands may be executed, and the FIPS hardware security module (HSM) may fail to initialize. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2025
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-600155.7An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption. Note: Software versions which h CVE-2025-600167.5When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cipher Rule or Cipher G CVE-2025-600178.2Unitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass par CVE-2025-600184.8glib-networking's OpenSSL backend fails to properly check the return value of a call to BIO_write(), resulting in an out of bounds read.CVE-2025-600193.7glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could p CVE-2025-60027.2An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload CVE-2025-600206.4nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.CVE-2025-600219.8Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows att CVE-2025-600222.3Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a ma CVE-2025-600234.0A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthen CVE-2025-600248.8Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet CVE-2025-60035.3The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a fu