CVE-2025-9176

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-9176
A security flaw has been discovered in neurobin shc up to 4.0.3. Impacted is the function make of the file src/shc.c of the component Environment Variable Handler. The manipulation results in os command injection. The attack is only possible with local access. The exploit has been released to the public and may be exploited.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 3.1 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://magnificent-dill-351.notion.site/Command-Execution-of-env-in-shc-4-0-3-249c693918ed80c997f4e9420f945d01
https://vuldb.com/?ctiid.320557
https://vuldb.com/?id.320557
https://vuldb.com/?submit.630744
https://magnificent-dill-351.notion.site/Command-Execution-of-env-in-shc-4-0-3-249c693918ed80c997f4e9420f945d01
Configurations

No configuration.

History

20 Aug 2025, 16:15

Type Values Removed Values Added
References () https://magnificent-dill-351.notion.site/Command-Execution-of-env-in-shc-4-0-3-249c693918ed80c997f4e9420f945d01 - () https://magnificent-dill-351.notion.site/Command-Execution-of-env-in-shc-4-0-3-249c693918ed80c997f4e9420f945d01 -

20 Aug 2025, 14:39

Type Values Removed Values Added
Summary
  • (es) Se ha descubierto una falla de seguridad en neurobin shc hasta la versión 4.0.3. La función "make" del archivo src/shc.c del componente Environment Variable Handler se ve afectada. La manipulación resulta en la inyección de comandos del sistema operativo. El ataque solo es posible con acceso local. Se ha hecho público el exploit y puede que sea utilizado.

20 Aug 2025, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-20 00:15

Updated : 2025-08-20 16:15

NVD link : CVE-2025-9176

Mitre link : CVE-2025-9176

CVE.ORG link : CVE-2025-9176

JSON object : View

Products Affected

No product.

CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')