CVE-2025-0396

exelban stats XPC Service shouldAcceptNewConnection command injection

Severity Score

8.5

*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

NVD
MITRE

A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading to version 2.11.22 is able to address this issue. It is recommended to upgrade the affected component.

Eine Schwachstelle wurde in exelban stats bis 2.11.21 entdeckt. Sie wurde als kritisch eingestuft. Hierbei geht es um die Funktion shouldAcceptNewConnection der Komponente XPC Service. Dank der Manipulation mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Umgesetzt werden muss der Angriff lokal. Ein Aktualisieren auf die Version 2.11.22 vermag dieses Problem zu lösen. Als bestmögliche Massnahme wird das Einspielen eines Upgrades empfohlen.

*Credits: winslow1984

CVSS Scores

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

System

Vulnerable | Subsequent

Confidentiality

High

None

Integrity

High

None

Availability

High

None

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

Poc

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2025-01-11 CVE Reserved
2025-01-12 CVE Published
2025-01-13 CVE Updated
2025-01-13 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

CAPEC

References (4)

URL	Tag	Source
https://vuldb.com/?id.291269	Technical Description
https://vuldb.com/?submit.473229	Third Party Advisory
https://winslow1984.com/books/cve-collection/page/stats-v21122-local-privilege-escalation	Related

URL	Date	SRC

URL	Date	SRC
https://github.com/exelban/stats/releases/tag/v2.11.22	2025-01-12

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.0 Search vendor "Exelban" for product "Stats" and version "2.11.0"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.1 Search vendor "Exelban" for product "Stats" and version "2.11.1"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.2 Search vendor "Exelban" for product "Stats" and version "2.11.2"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.3 Search vendor "Exelban" for product "Stats" and version "2.11.3"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.4 Search vendor "Exelban" for product "Stats" and version "2.11.4"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.5 Search vendor "Exelban" for product "Stats" and version "2.11.5"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.6 Search vendor "Exelban" for product "Stats" and version "2.11.6"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.7 Search vendor "Exelban" for product "Stats" and version "2.11.7"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.8 Search vendor "Exelban" for product "Stats" and version "2.11.8"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.9 Search vendor "Exelban" for product "Stats" and version "2.11.9"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.10 Search vendor "Exelban" for product "Stats" and version "2.11.10"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.11 Search vendor "Exelban" for product "Stats" and version "2.11.11"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.12 Search vendor "Exelban" for product "Stats" and version "2.11.12"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.13 Search vendor "Exelban" for product "Stats" and version "2.11.13"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.14 Search vendor "Exelban" for product "Stats" and version "2.11.14"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.15 Search vendor "Exelban" for product "Stats" and version "2.11.15"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.16 Search vendor "Exelban" for product "Stats" and version "2.11.16"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.17 Search vendor "Exelban" for product "Stats" and version "2.11.17"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.18 Search vendor "Exelban" for product "Stats" and version "2.11.18"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.19 Search vendor "Exelban" for product "Stats" and version "2.11.19"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.20 Search vendor "Exelban" for product "Stats" and version "2.11.20"		en		Affected
Exelban Search vendor "Exelban"		Stats Search vendor "Exelban" for product "Stats"				2.11.21 Search vendor "Exelban" for product "Stats" and version "2.11.21"		en		Affected