{"vulnerability": "cve-2025-5995", "sightings": [{"uuid": "525cb6c3-f28b-4daa-b3bd-612e49f7b306", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-5995", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lskfgvvkx223", "content": "", "creation_timestamp": "2025-06-27T00:35:11.026271Z"}, {"uuid": "f326eda2-1b4f-44b2-9eae-03c3ec2d16be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59951", "type": "seen", "source": "https://gist.github.com/Darkcrai86/b01f8b9aa3ee340d5d027fe3352f71ee", "content": "", "creation_timestamp": "2025-10-02T06:47:12.000000Z"}, {"uuid": "5f912eea-5293-43fb-84f2-0a20caad4ad1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59951", "type": "seen", "source": "https://bsky.app/profile/crowdcyber.bsky.social/post/3m2aq3jaoc523", "content": "", "creation_timestamp": "2025-10-02T23:40:35.565145Z"}, {"uuid": "bd110b7f-e4e5-4b25-b0af-3fc723baff54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-59954", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3lzz7x4t6a72a", "content": "", "creation_timestamp": "2025-09-30T00:03:10.742372Z"}, {"uuid": "ef35f462-6a06-4531-8625-13c874d80a7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59951", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3m2fi26jtgc2i", "content": "", "creation_timestamp": "2025-10-04T20:59:59.745783Z"}, {"uuid": "9f2e74f0-0e12-4b4c-addd-52d04e823a53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59954", "type": "seen", "source": "https://gist.github.com/Darkcrai86/31fc33822b7180e25c47854c3fd86e76", "content": "", "creation_timestamp": "2025-09-30T07:02:14.000000Z"}, {"uuid": "f34985cf-a2aa-40dc-87c2-14c6864bac89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59958", "type": "seen", "source": "https://bsky.app/profile/infosecindustry.bsky.social/post/3m2oz4kzcro2m", "content": "", "creation_timestamp": "2025-10-08T15:59:32.058398Z"}, {"uuid": "38f06eec-ec51-4d96-8caa-af1dd6d68c98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59957", "type": "seen", "source": "https://bsky.app/profile/infosecindustry.bsky.social/post/3m2oz4lqlev26", "content": "", "creation_timestamp": "2025-10-08T15:59:32.554684Z"}, {"uuid": "0305a461-28c4-4788-acef-81f3e0ecbbe1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-59951", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3m26avptvbp2s", "content": "", "creation_timestamp": "2025-10-02T00:03:36.127248Z"}, {"uuid": "5f29f543-baee-40ce-8647-ab990980e9eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59955", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mbpeq3j2fd2y", "content": "", "creation_timestamp": "2026-01-05T21:23:38.332438Z"}, {"uuid": "5a174f1a-5288-48ed-9474-dd83cd3538d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59951", "type": "seen", "source": "https://t.me/TengkorakCyberCrewzz/5686", "content": "Termix Docker Image Leaking SSH Credentials (CVE-2025-59951) \u2013 gbhackers.com\n\nThu, 02 Oct 2025 16:22:12", "creation_timestamp": "2025-10-02T12:03:03.000000Z"}, {"uuid": "5e5cd478-985f-4eed-9800-18e1adb1b19f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-5995", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/19647", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-5995\n\ud83d\udd25 CVSS Score: 4.6 (cvssV4_0, Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)\n\ud83d\udd39 Description: Canon EOS Webcam Utility Pro for MAC OS version 2.3d\n(2.3.29) and earlier contains an improper directory permissions vulnerability.\nExploitation of this vulnerability requires administrator access by a malicious\nuser. An attacker could modify the directory, potentially resulting in code\nexecution and ultimately leading to privilege escalation.\n\ud83d\udccf Published: 2025-06-26T19:13:48.305Z\n\ud83d\udccf Modified: 2025-06-26T19:33:44.616Z\n\ud83d\udd17 References:\n1. https://www.usa.canon.com/about-us/to-our-customers/vulnerability-mitigation-remediation-for-canon-eos-webcam-utility-pro-for-mac-os\n2. https://www.canon-europe.com/psirt/advisory-information", "creation_timestamp": "2025-06-26T19:50:47.000000Z"}, {"uuid": "ed4cf389-fcd8-42a2-acda-454917a96d43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59951", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/16560", "content": "Termix Docker Image Leaking SSH Credentials (CVE-2025-59951) \u2013 gbhackers.com\n\nThu, 02 Oct 2025 16:22:12", "creation_timestamp": "2025-10-02T12:03:03.000000Z"}, {"uuid": "0895e88e-3fdd-4e09-bbae-96591e5125d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59951", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/7496", "content": "Termix Docker Image Leaking SSH Credentials (CVE-2025-59951) \u2013 gbhackers.com\n\nThu, 02 Oct 2025 16:22:12", "creation_timestamp": "2026-07-20T19:00:05.841214Z"}, {"uuid": "4e890b4e-1e4e-43d2-b274-cfb49e2f2f9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-59953", "type": "published-proof-of-concept", "source": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-5h8j-6crg-7rmw", "content": "", "creation_timestamp": "2026-09-16T16:35:02.155197Z"}, {"uuid": "f18edfe9-6618-4c54-a490-73892741de80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59953", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/cfid76vzr44xo", "content": "CVE-2025-59953 - LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy\nCVE ID : CVE-2025-59953\n \n Published : Sept. 16, 2026, 3:36 p.m. | 9\u00a0minutes ago\n \n Description : LMDeploy is a toolkit for compressing, deploying,...", "creation_timestamp": "2026-09-16T17:20:31.991608Z"}, {"uuid": "1223e08a-f52d-4c7a-abb4-365f250e7cc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59953", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvnq7qjmsm25", "content": "\ud83d\udea8 CVE-2025-59953 \u2014 CVSS 9.8 CRITICAL\n\nLMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2025-59953\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-16T18:07:47.772136Z"}, {"uuid": "04c20391-7b60-4cda-a9c3-4395648b4f8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59953", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvnqvpl4ba2b", "content": "CVE-2025-59953 - lmdeploy\nThe LMdeploy software includes an RPC server that accepts messages and deserializes them without checking their content. An attacker who can send a specially crafted message\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#lmdeploy #internlm #pip #CVE #infosec", "creation_timestamp": "2026-09-16T18:20:05.843424Z"}, {"uuid": "895e0f16-adab-4d4a-9d0a-58f34809db38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59953", "type": "seen", "source": "https://gist.github.com/alon710/efe1b2090e21bb0a7cf5f18ce00c2614", "content": "# CVE-2025-59953: CVE-2025-59953: Unauthenticated Remote Code Execution in LMDeploy AsyncRPCServer via Insecure Pickle Deserialization\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2025-59953\n\n## Summary\nLMDeploy prior to version 0.10.2 is vulnerable to remote code execution because its AsyncRPCServer component implements unauthenticated, remote-accessible communication sockets and uses the insecure pickle.loads() deserializer to process incoming requests.\n\n## TL;DR\nUnauthenticated remote attackers can execute arbitrary code on LMDeploy hosts prior to v0.10.2 by sending a malicious Python pickle stream to the dynamically opened ZMQ RPC port.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-502\n- **Attack Vector**: Network\n- **Complexity**: Low\n- **Privileges Required**: None\n- **EPSS Score**: N/A\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- lmdeploy\n- **lmdeploy**: >= 0.9.1, < 0.10.2 (Fixed in: `0.10.2`)\n\n## Mitigation\n\n- Upgrade LMDeploy to 0.10.2 or higher\n- Implement firewall rules to block high random ports\n- Use local container network namespaces without host networking\n- Run services under a non-root low-privileged user account\n\n**Remediation Steps:**\n1. Run pip install --upgrade lmdeploy\n2. Verify local binding in zmq_rpc.py is localhost\n3. Establish micro-segmentation rules on model server host nodes\n\n## References\n\n- [GitHub Security Advisory GHSA-5h8j-6crg-7rmw](https://github.com/InternLM/lmdeploy/security/advisories/GHSA-5h8j-6crg-7rmw)\n- [Commit d86046a0e6b02ecaaf7cdb74346d0477130221c2](https://github.com/InternLM/lmdeploy/commit/d86046a0e6b02ecaaf7cdb74346d0477130221c2)\n- [LMDeploy v0.10.2 Release](https://github.com/InternLM/lmdeploy/releases/tag/v0.10.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2025-59953) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T18:31:42.521113Z"}]}